SmitFraudFix v2.423 (WinXP, Win2K)

Screen shots - Tutorial Fran�ais - English Tutorial - Deutsche Anleitung - Blog

Changelog:

Version 2.423 (June 24, 2009)


[-HKEY_CURRENT_USER\Software\ColdWare]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinProtect"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"winupdate.exe"=-
"ColdWare"=-

%SYSTEM%\AVR09.exe
%SYSTEM%\msa.exe



Version 2.422 (June 11, 2009)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B1D95A2-F547-4e5e-8902-622B08354622}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5B1D95A2-F547-4e5e-8902-622B08354622}]

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk
%STARTMENU%\Advanced Virus Remover.lnk
%DESKTOP%\Advanced Virus Remover.lnk
%PROGRAMFILES%\AdvancedVirusRemover\

[-HKEY_CURRENT_USER\Software\AVR]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced Virus Remover"=-



Version 2.421 (June 10, 2009)


%WINDOWS%\ld09.exe
%PROGRAMFILES%\podmena

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PODMENA]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PODMENADRV]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\podmena]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\podmenadrv]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PODMENA]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PODMENADRV]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\podmena]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\podmenadrv]



Version 2.420 (June 10, 2009)


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mediacodec.exe"=-



Version 2.419 (June 4, 2009)


%DESKTOP%\XP Deluxe Protector.lnk
%STARTMENU%\XP Deluxe Protector.lnk
%USERPROFILE%\XP Deluxe Protector\

[-HKEY_CURRENT_USER\Software\XP Deluxe Protector]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"xpprotect"=-



Version 2.418 (June 2, 2009)


Update: WS2Fix v1.3

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\UnVirex.lnk
%ALLUSERSTARTMENU%\Programs\UnVirex\
%ALLUSERSTARTMENU%\Programs\UnVirex.lnk
%ALLUSERDESKTOP%\UnVirex.lnk
%PROGRAMFILES%\UnVirex\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEAddon.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C0E56Ac2-9F72-436E-B6E7-Aec28Af9E4Eb}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCB5551D-8594-4999-85F9-1E3EABCB95AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B184B9D-B7BD-4FEA-8D1F-5E27182206A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3ED0E410-5C8E-47B6-A75D-D10B886E903C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEAddon.StatusBarPane]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEAddon.StatusBarPane.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCB5551D-8594-4999-85F9-1E3EABCB95AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UnVirex]
[-HKEY_LOCAL_MACHINE\SOFTWARE\UnVirex]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DRVFLTIP]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DrvFltIp]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVFLTIP]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DrvFltIp]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"UnVirex"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnVirex"=-



Version 2.417 (May 23, 2009)


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Presto TuneUp"=-

%WINDOWS%\pp10.exe
%SYSTEM%\SYSDLL.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SYSDLL"=-



Version 2.416 (May 06, 2009)


%SYSTEM%\SYS32DLL.exe

%PROGRAMFILES%\PCenter\

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SYS32DLL"=-
"agent.exe"=-



Version 2.415 (April 30, 2009)


O2 - BHO: (no name) - {3B7AAEB1-9F3D-4491-9C06-C7165CA8D058} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}]



Version 2.414 (April 30, 2009)


%SYSTEM%\DL32.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DL32"=-



Version 2.413 (April 29, 2009)


Update: WS2Fix v1.2


%USER%\Application Data\pcdefender.exe
%USER%\Application Data\svchost_32.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"sysav"=-
"dll32"=-

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Coreguard 2009.lnk
%DESKTOP%\Coreguard 2009.lnk
%STARTMENU%\Programs\Coreguard Antivirus 2009\
%PROGRAMFILES%\Coreguard Antivirus 2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coreguard Antivirus 2009]
[-HKEY_CURRENT_USER\Software\CoreGuard]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Coreguard Antivirus 2009"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VShield.DocHostUIHandler]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Virus Shield 2009"=-



Version 2.412 (April 20, 2009)


%HOMEDRIVE%\asasa.exe
%HOMEDRIVE%\syst.exe
%PROGRAMFILES%\Microsoft Security Adviser\

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msctrl.exe"=-
"msavsc.exe"=-
"msscan.exe"=-
"msiemon.exe"=-
"msfw.exe"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msctrl.exe"=-
"msavsc.exe"=-
"msscan.exe"=-
"msiemon.exe"=-
"msfw.exe"=-


%ALLUSERS%\ApplicationData\Tally software LTD\
%STARTMENU%\Programs\Extra Antivirus\

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\uninstall\Extra Antivirus 3.0]
[-HKEY_CURRENT_USER\Software\Tally software LTD]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Extra Antivirus"=-



Version 2.411 (April 18, 2009)


%STARTMENU%\Programs\AV AntiSpyware\
%ALLUSERS%\ApplicationData\LastSun Ltd\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AV AntiSpyware 1.8]
[-HKEY_CURRENT_USER\Software\LastSun Ltd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AV AntiSpyware"=-



Version 2.410 (April 18, 2009)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\load1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\browser helper objects\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]

%SYSTEM%\ipv6monl.dll


[-HKEY_LOCAL_MACHINE\SOFTWARE\WiniBlueSoft]
[-HKEY_CURRENT_USER\Software\WiniBlueSoft]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiniBlueSoft]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WiniBlueSoft"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"setup2.exe"=-

%SYSTEM%\setup2.exe

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\WiniBlueSoft.lnk
%ALLUSERSTARTMENU%\Programs\WiniBlueSoft\
%ALLUSERDESKTOP%\WiniBlueSoft.lnk
%PROGRAMFILES%\WiniBlueSoft Software\



Version 2.409 (April 17, 2009)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\homeantivirus2009.lnk
%STARTMENU%\Programs\homeantivirus2009\
%DESKTOP%\homeantivirus2009.lnk
%PROGRAMFILES%\homeantivirus2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HomeAntivirus2009]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HomeAntivirus 2009"=-



Version 2.408 (April 09, 2009)


%SYSTEM%\ahtn.htm
%SYSTEM%\warning.gif
%SYSTEM%\frmwrk32.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Framework Windows"=-

%STARTMENU%\Programs\MS AntiSpyware 2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusXP]

[-HKEY_CURRENT_USER\Software\AntivirusXP]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AntivirusXP.exe"=-

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusXP.lnk
%DESKTOP%\AntivirusXP.lnk
%STARTMENU%\Programs\AntivirusXP\
%PROGRAMFILES%\AntivirusXP\



Version 2.407 (April 07, 2009)


DNS.Changer RK detection



Version 2.406 (April 04, 2009)


Added: Option 6, ProxyDisable.exe

%WINDOWS%\ld03.exe
%WINDOWS%\pp06.exe

%SYSTEM%\winsource.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}]

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\TSC.lnk
%DESKTOP%\TSC.lnk
%STARTMENU%\Programs\TSC\
%PROGRAMFILES%\TSC\


%SYSTEM%\userload.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"restor"=-



Version 2.405 (March 18, 2009)


%WINDIR%\ieocx.dll
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEocxApp.IEocx]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEocxApp.IEocx.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A54DC52D-7AAD-4D40-A126-337211631EDC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}]


%DESKTOP%\WinPC Defender.lnk
%STARTMENU%\WinPC Defender.lnk

[-HKEY_CURRENT_USER\Software\WinPC Defender]


%SYSTEM%\rs32net.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"rs32net"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"rs32net"=-


[-HKEY_CURRENT_USER\Software\renus2008]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"renus2008.exe"=-



Version 2.404 (March 16, 2009)


%USERPROFILE%\Application Data\sysrc32.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Win32load"=-



Version 2.403 (March 12, 2009)


%ProgramFiles%\AntiSpyware Pro

%PROGRAMFILES%\RegistryFox\
%ALLUSERDESKTOP%\RegistryFox.lnk
%USERPROFILE%\Application Data\RegistryFox\
%ALLUSERSTARTMENU%\Programmes\RegistryFox\

[-HKEY_CURRENT_USER\SOFTWARE\RegistryFox]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\6B4F6929EB6FE0E458263EBA6AF2EB30]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\6B4F6929EB6FE0E458263EBA6AF2EB30]
[-HKEY_LOCAL_MACHINE\SOFTWARE\RegistryFox]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9296F4B6-F6BE-4E0E-8562-E3ABA62FBE03}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RegistryFox"=-



Version 2.402 (March 11, 2009)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe svchostw.exe"

%SYSTEM%\svchostw.exe



Version 2.401 (March 09, 2009)

%WINDOWS%\ld01.exe
%WINDOWS%\ld02.exe
%WINDOWS%\pp2.exe
%SYSTEM%\dll32.exe
%SYSTEM%\dll32.dll


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dll"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sysldtray"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pp"=-

%STARTMENU%\Programs\Malware Defender 2009\
%DESKTOP%\Malware Defender 2009.lnk
%PROGRAMFILES%\Malware Defender 2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware Defender 2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defender 2009]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"malwaredef"=-


%STARTMENU%\Programs\System Guard 2009\
%DESKTOP%\System Guard 2009.lnk
%PROGRAMFILES%\System Guard 2009\
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\DLLs\iemodule.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Guard 2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\System Guard 2009]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"systemguard"=-



Version 2.400 (March 05, 2009)


%WINDOWS%\iehost32.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"system tool"=-



Version 2.399 (March 04, 2009)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\GenericMultiMedia]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WmpTray"=-

%PROGRAMFILES%\MediaSystem\



Version 2.398 (February 19, 2009)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Internet Agent"=-
%SYSTEM%\winagent.exe


%PROGRAMFILES%\HDQuality\
%STARTMENU%\Programs\HDQuality\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HDQuality]
[-HKEY_CURRENT_USER\SOFTWARE\HDQuality]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HDQuality]



Version 2.397 (February 16, 2009)


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"[IA3_]"=-

%WINDOWS%\iehost.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12c7290a-157b-4f43-b109-97e792c598ed}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8A10FC9B-8D76-4E95-A9BE-ACDA2F665C30}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinGDIApp.WinGDI]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinGDIApp.WinGDI.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12c7290a-157b-4f43-b109-97e792c598ed}]



Version 2.396 (February 15, 2009)


%PROGRAMFILES%\CMVideoPlugin

%PROGRAMFILES%\SmitFraudFixTool\
%ALLUSERDESKTOP%\SmitFraudFixTool.lnk
%USERPROFILE%\\Application Data\SmitFraudFixTool\
%ALLUSERSTARTMENU%\Programs\SmitFraudFixTool\

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SmitFraudFixTool"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10EE433D-A290-4811-B562-8A1878AEE706}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{10EE433D-A290-4811-B562-8A1878AEE706}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB63BB6D-4A8A-4E69-9F4B-E099C874A2AA}]
[-HKEY_CURRENT_USER\Software\SmitFraudFixTool]



Version 2.395 (February 9, 2009)


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"systeminit.exe"=-



Version 2.394 (February 8, 2009)


%PROGRAMFILES%\freshplay\
%STARTMENU%\Programs\freshplay

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\freshplay]
[-HKEY_CURRENT_USER\SOFTWARE\freshplay]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\freshplay]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFolderOptions"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFolderOptions"=-

%ALLUSERPROFILE%\Application Data\CrucialSoft Ltd\

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\uninstall\MS AntiSpyware 2009 5.7]
[-HKEY_CURRENT_USER\Software\CrucialSoft Ltd]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MS AntiSpyware 2009"=-



Version 2.393 (February 7, 2009)

%WINDOWS%\sysguard.exe
%SYSTEM%\iehelper.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}]
[-HKEY_CURRENT_USER\Software\AvScan]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"sysguard"=-



Version 2.392 (January 27, 2009)


%SYSTEM%\winsystems.dll

%STARTMENU%\Programs\IE-Security.lnk
%DESKTOP%\IE-Security.lnk
%PROGRAMFILES%\IE-Security\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE-Security]
[-HKEY_CURRENT_USER\Software\IE-Security]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IE-Security"=-

%STARTMENU%\XP Police Antivirus.lnk
%DESKTOP%\XP Police Antivirus.lnk
%PROGRAMFILES%\XPPoliceAntivirus\

[-HKEY_CURRENT_USER\Software\XP Police Antivirus]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PoliceAV"=-



Version 2.391 (January 14, 2009)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\CMVideo.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{36B94DC8-FA3B-45DF-8F6B-215A2A469BCC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D23EE44-2319-4B6C-93D2-A572E0F5B0E0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B87FA0EF-26D7-4B2A-B7EE-38C7271C4843}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2EB32B07-6A19-4D18-9A19-4DE49F18A1FB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{638E0063-BA00-487C-BAFF-423E356F52F6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AC4A66D0-BB91-45E5-BB00-E0F091F630B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D23EE44-2319-4B6C-93D2-A572E0F5B0E0}]
[-HKEY_CURRENT_USER\Software\CMVideoPlugin]

%SYSTEM%\CMVideo.dll

%PROGRAMFILES%\totalvid\



Version 2.390 (January 07, 2009)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar]



Version 2.389 (January 05, 2009)


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msiexec.exe"=-



Version 2.388 (December 31, 2008)


%STARTMENU%\Programs\videosoft\
%PROGRAMFILES%\videosoft\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\videosoft]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\videosoft]
[-HKEY_CURRENT_USER\Software\videosoft]


%PROGRAMFILES%\Total Protect 2009\
%ALLUSERPROFILE%\StartMenu\Programs\Total Protect 2009\
%ALLUSERPROFILE%\Desktop\Run Total Protect 2009.lnk

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\totalprotect]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\totalprotect]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Total Protect 2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Software]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Total Protect 2009"=-



Version 2.387 (December 17, 2008)


%WINDIR%\fd.dll



Version 2.386 (December 15, 2008)


Update: Hostschk 0.2 (10 lines max in log)



Version 2.385 (December 12, 2008)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 360.lnk
%STARTMENU%\Antivirus 360\
%DESKTOP%\Antivirus 360.lnk
%PROGRAMFILES%\A360\



Version 2.384 (December 11, 2008)


Added: Agent.OMZ.Fix.exe tool to remove Zlob hidden folder.



Version 2.383 (December 10, 2008)


%PROGRAMFILES%\vrl32software\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E6615B5-A259-4e55-905F-7F9CE60B379D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{305043E5-F9D9-4B3A-A618-C4D0DA8031CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{536CBA8A-9DB6-45CF-8D65-F486C49242D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B3A0AA5C-9FA3-408D-8193-2A948EF51D2D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vrl32Warning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vrl32Warning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\vrl32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E6615B5-A259-4e55-905F-7F9CE60B379D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vrl32]
[-HKEY_CURRENT_USER\Software\vrl32]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\vrl32software\vrl32.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\vrl32software\vrl32.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"vrl32"=-



Version 2.382 (December 9, 2008)


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Smax4"=-

%USERPROFILE%\Application Data\Google\kjzna1562565.exe
%USERPROFILE%\Application Data\Google\spcffwl.dll



Version 2.381 (December 3, 2008)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"QuickTime Task"=-
"VMware hptray"=-


%PROGRAMFILES%\avrlabs\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D695B871-8020-4041-A6D2-59F922E1B2E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avrlabsWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avrlabsWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\avrlabs]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D695B871-8020-4041-A6D2-59F922E1B2E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avrlabs]
[-HKEY_CURRENT_USER\Software\avrlabs]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\avrlabs\avrlabs.exe"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
"C:\Program Files\avrlabs\avrlabs.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"avrlabs"=-



Version 2.380 (November 30, 2008)


%PROGRAMFILES%\WebMediaViewer\

O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]

O3 - Toolbar: Browser Toolbar - {2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E} - C:\Program Files\WebMediaViewer\browseul.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E}"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3B8FB116-D358-48A3-A5C7-DB84F15CBB04}]


%PROGRAMFILES%\AnvTrgrsoftware\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E9BCC0-2E84-4500-8A9C-0B7A96769124}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C8B2A9C-24A0-4991-A74B-1E4931BD3A57}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF3F06C6-D443-48A8-BDF2-4E31F0554EBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BAE92F67-539C-41CD-9183-162BB40AAA0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AnvTrgrWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AnvTrgrWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AnvTrgrsoft]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95E9BCC0-2E84-4500-8A9C-0B7A96769124}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnvTrgrsoft]
[-HKEY_CURRENT_USER\Software\AnvTrgrsoft]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AnvTrgrsoftware\AnvTrgr.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AnvTrgrsoftware\AnvTrgr.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AnvTrgr"=-



Version 2.379 (November 29, 2008)

Update: IEDFix.C 1.12



Version 2.378 (November 24, 2008)

%PROGRAMFILES%\AvirTrsoftware\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3A267370-076E-4af4-B986-77626B8E89DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{764BC8B4-1159-4736-8AF1-F124A7C8C3A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF3F06C6-D443-48A8-BDF2-4E31F0554EBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3ED86073-2FA7-4CF4-810B-28B030671678}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvirTrWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvirTrWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AvirTrsoft]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A267370-076E-4af4-B986-77626B8E89DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AvirTrsoft]
[-HKEY_CURRENT_USER\Software\AvirTrsoft]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AvirTrsoftware\AvirTr.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AvirTrsoftware\AvirTr.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AvirTr"=-



Version 2.377 (November 21, 2008)


%PROGRAMFILES%\WMVideoPlugin\
%SYSTEM%\mws31209.dll
%SYSTEM%\ws31209.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC3081A6-AC0C-331D-860E-AEF4790E6B5B}]
[-HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{C77BD12E-4A3C-33E3-858C-F2D04591C6B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BB62EE8-3528-39F7-9070-F9F0C09329D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC3081A6-AC0C-331D-860E-AEF4790E6B5B}]



Version 2.376 (November 20, 2008)


%PROGRAMFILES%\msvideoplugin\
%PROGRAMFILES%\homeview\
%STARTMENU%\Programs\homeview\


%SYSTEM%\mws55681.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6733C78-821F-3BBF-ADE6-3DB71CAD887A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F6733C78-821F-3BBF-ADE6-3DB71CAD887A}]


%SYSTEM%\msiconf.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msiexec.exe"=-


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\antivirustrigger 2.1.lnk
%STARTMENU%\antivirustrigger 2.1.lnk
%STARTMENU%\Programs\antivirustrigger 2.1\
%DESKTOP%\antivirustrigger 2.1.lnk
%PROGRAMFILES%\virtrigger\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0088C75C-6361-4dfb-B2CF-576CACFA3C55}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22C447D3-73A8-E1C7-C391-21BE4338CEBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirTriggerWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirTriggerWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirTrigger]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0088C75C-6361-4dfb-B2CF-576CACFA3C55}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirTrigger]
[-HKEY_CURRENT_USER\Software\VirTrigger]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirTrigger\VirTrigger.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirTrigger\VirTrigger.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirTrigger"=-



Version 2.375 (November 12, 2008)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusTrigger 2.1.lnk
%STARTMENU%\VirusTrigger 2.1.lnk
%STARTMENU%\Programs\VirusTriggerBin\
%DESKTOP%\VirusTrigger 2.1.lnk
%PROGRAMFILES%\VirusTriggerBin\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE8A3F7B-E4AB-5C41-4926-3FAED82759F5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirusTriggerBinWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirusTriggerBinWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusTriggerBin]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusTriggerBin]
[-HKEY_CURRENT_USER\Software\VirusTriggerBin]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusTriggerBin\VirusTriggerBin.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusTriggerBin\VirusTriggerBin.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirusTriggerBin"=-



Version 2.374 (November 09, 2008)


%PROGRAMFILES%\Google\googletoolbar1.dll
%PROGRAMFILES%\Google\setupcom.dat
%PROGRAMFILES%\Google\setupext.dat
%SYSTEM%\crypts.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt]


O2 - BHO: (no name) - {8710DF42-3171-4A3B-9079-3F7D7101552B} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8710DF42-3171-4A3B-9079-3F7D7101552B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8710DF42-3171-4A3B-9079-3F7D7101552B}]

O3 - Toolbar: Internet Service - {E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}"=-



Version 2.373 (November 06, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Guard 2008]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Spyware Guard]
[-HKEY_CURRENT_USER\Software\Spyware Guard]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"spywareguard"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"OLESys"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Explorer"=-

%USERSTARTMENU%\Programs\Spyware Guard 2008\
%PROGRAMFILES%\Spyware Guard 2008\

%allusersprofile%\Application Data\Microsoft\Internet Explorer\olesys.dll
%allusersprofile%\Application Data\Microsoft\Protect\conf.sys
%allusersprofile%\Application Data\Microsoft\Protect\ie.dll
%allusersprofile%\Application Data\Microsoft\Protect\svhost.exe
%allusersprofile%\Application Data\Microsoft\Protect\track.sys
%allusersprofile%\Application Data\winlogon.exe
%DESKTOP%\Spyware Guard 2008.lnk
%WINDOWS%\reged.exe
%WINDOWS%\spoolsystem.exe
%WINDOWS%\sys.com
%WINDOWS%\syscert.exe
%WINDOWS%\sysexplorer.exe
%WINDOWS%\vmreg.dll
%SYSTEM%\wsc32x.exe



Version 2.372 (November 06, 2008)


Removed: AntiXPVSTFix tool



Version 2.371 (October 31, 2008)


%USERSTARTMENU%\Programs\sexvid\
%PROGRAMFILES%\sexvid\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sexvid]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sexvid]
[-HKEY_CURRENT_USER\Software\sexvid]


%TEMP%\winlogon.exe
%SYSTEM%\msansspc.dll

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Firewall auto setup"=-



Version 2.370 (October 31, 2008)


%userprofile%\Application Data\Google\sccmsk.dll
%userprofile%\Application Data\Google\mupd1_2_1711951.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"asus32"=-

%USERSTARTMENU%\Personal Defender 2009.lnk
%USERSTARTMENU%\Programs\Personal Defender 2009\
%PROGRAMFILES%\Personal Defender 2009\

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Personal Defender 2009"=-



Version 2.369 (October 30, 2008)


%USERSTARTMENU%\Programs\WinDefender 2009.lnk
%DESKTOP%\WinDefender 2009.lnk
%PROGRAMFILES%\WinDefender

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDefender 2009]
[-HKEY_CURRENT_USER\Software\WinDefender2009]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WinDefender2009"



Version 2.368 (October 28, 2008)


%DESKTOP%\SMS TRAP.url
%FAVORITES%\SMS TRAP.url
%STARTMENU%\SMS TRAP.url
%SYSTEM%\p.ico

%DESKTOP%\AntiVirus Sentry.lnk
%PROGRAMFILES%\AVS\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVS]
[-HKEY_CURRENT_USER\Software\AVS]



Version 2.367 (October 26, 2008)


%SYSTEM%\ntload.dll
%SYSTEM%\sex1.ico.tmp
%SYSTEM%\sex2.ico.tmp
%SYSTEM%\update32.exe.tmp
%SYSTEM%\winupdate.exe
%SYSTEM%\wscmp.dll.tmp
%DESKTOP%\Uncensored porn.url
%DESKTOP%\BDSM galleries.url

%SYSTEM%\winupdate.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"run"=-



%PROGRAMFILES%\VResLab\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B494E7BB-1E33-4922-A947-F74EFF4E714F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VResLabWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VResLabWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VResLab]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B494E7BB-1E33-4922-A947-F74EFF4E714F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VResLab]
[-HKEY_CURRENT_USER\Software\VResLab]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VResLab\VResLab.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VResLab\VResLab.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VResLab"=-



Version 2.366 (October 21, 2008)


%WINDIR%\woprdagt.exe
%PROGRAMFILES%\TS-2009



Version 2.365 (October 18, 2008)


%USERPROFILE%\Application Data\spyprotector\
%USERPROFILE%\Application Data\install.exe
%USERPROFILE%\Application Data\shellex.dll
%USERPROFILE%\Application Data\srcss.exe
%ALLUSERSTARTMENU%\Programs\spy protector\
%DESKTOP%\spy protector.lnk
%PROGRAMFILES%\spy protector\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Spy Protector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CBE202A6-3B75-4189-B161-9B4DF370BEE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Spy Protector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Spy Protector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\shellex.TBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\srcss.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBE202A6-3B75-4189-B161-9B4DF370BEE9}]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\SpyProtector]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spy Protector"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{107A1D63-2EAA-4694-8ABA-EC209C630D83}"=-



Version 2.364 (October 18, 2008)


%HOMEDRIVE%\resycled
%HOMEDRIVE%\autorun.inf

Restoring infected %SYSTEM%\userinit.exe

%USERSTARTMENU%\Programs\Pornovid\
%PROGRAMFILES%\Pornovid
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Pornovid]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pornovid]
[-HKEY_CURRENT_USER\Software\Pornovid]



Version 2.363 (October 17, 2008)


%ALLUSERSTARTMENU%\Programs\PC Protection Center 2008\
%ALLUSERDESKTOP%\PC Protection Center 2008.lnk
%PROGRAMFILES%\PC Protection Center 2008\
%SYSTEM%\vbzlib2.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Protection Center 2008]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Software]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Protection Center"=-


%WINDOWS%\ieguard.dll
%WINDOWS%\sysguard\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D032570A-5F63-4812-A094-87D007C23012}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ieguard.TIEAdvBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sysguard]
[-HKEY_CURRENT_USER\Software\sysguard]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"=-



Version 2.362 (October 16, 2008)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRemover2008]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusRemover2008]
[-HKEY_LOCAL_MACHINE\SOFTWARE\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
[-HKEY_CURRENT_USER\Software\VirusRemover2008]
[-HKEY_CURRENT_USER\{5222008A-DD62-49c7-A735-7BD18ECC7350}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusRemover2008"=-

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\virusremover2008.lnk
%USERPROFILE%\Application Data\virusremover2008\
%STARTMENU%\Programs\virusremover2008\
%DESKTOP%\virusremover2008.lnk
%PROGRAMFILES%\virusremover2008\



Version 2.361 (October 14, 2008)


%SYSTEM%\msxml71.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XML.XML]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XML.XML.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
[-HKEY_CURRENT_USER\Software\XML]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSFox"=-



Version 2.360 (October 14, 2008)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusResponse Lab 2009 2.1.lnk (Already removed)
%STARTMENU%\VirusResponse Lab 2009 2.1.lnk (Already removed)
%STARTMENU%\Programs\VirusResponse Lab 2009 2.1\ (Already removed)
%DESKTOP%\VirusResponse Lab 2009 2.1.lnk (Already removed)
%PROGRAMFILES%\virrl2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirRLWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirRLWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirRL2009]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirRL2009]
[-HKEY_CURRENT_USER\Software\VirRL2009]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirRL2009\VirRL2009.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirRL2009\VirRL2009.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirRL2009"=-



Version 2.359 (October 11, 2008)


%WINDIR%\karna.dat
%SYSTEM%\brastk.exe
%SYSTEM%\karna.dat

O20 - AppInit_DLLs: C:\WINDOWS\System32\karna.dat

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"brastk"=-



Version 2.358 (October 10, 2008)

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusResponse Lab 2009 2.1.lnk (Already removed)
%STARTMENU%\VirusResponse Lab 2009 2.1.lnk (Already removed)
%STARTMENU%\Programs\VirusResponse Lab 2009 2.1\ (Already removed)
%DESKTOP%\VirusResponse Lab 2009 2.1.lnk (Already removed)
%PROGRAMFILES%\virusrl2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0DCD4F35-9FD5-420b-A9AA-FED0E2AECEE0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VRLWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VRLWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusRL2009]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DCD4F35-9FD5-420b-A9AA-FED0E2AECEE0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRL2009]
[-HKEY_CURRENT_USER\Software\VirusRL2009]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusRL2009\VirusRL2009.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusRL2009\VirusRL2009.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirusRL2009"=-


O2 - BHO: (no name) - {BE1A344F-9FF5-4024-949B-52205E6DB2D0} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BE1A344F-9FF5-4024-949B-52205E6DB2D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BE1A344F-9FF5-4024-949B-52205E6DB2D0}]



Version 2.357 (October 07, 2008)


%STARTMENU%\Programs\av2010\
%DESKTOP%\av2010.lnk
%PROGRAMFILES%\av2010\

%SYSTEM%\IEDefender.dll
%SYSTEM%\wingamma.exe

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEDefender.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{3C40236D-990B-443C-90E8-B1C07BCD4A68}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEDefender.IEDefenderBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEDefender.IEDefenderBHO.1]
[-HKEY_CURRENT_USER\Software\AV2010]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC8A493F-D236-4653-9A03-2BF4FD94F643}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Gamma Display"=-



Version 2.356 (October 01, 2008)


Update: VACFix definition




Version 2.355 (September 24, 2008)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cognac"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cognac"=-



Version 2.354 (September 23, 2008)


%SYSDIR%\m.ico
%STARTMENU%\Free MP3 Search.url
%FAVORITES%\Free MP3 Search.url
%DESKTOP%\Free MP3 Search.url

%SYSDIR%\p.ico
%STARTMENU%\Free Porn.url
%FAVORITES%\Free Porn.url
%DESKTOP%\Free Porn.url

%WINDIR%\k.txt


%SYSTEM%\fbxrqtwn.exe


%SYSTEM%\MicroAV.cpl
%DESKTOP%\Micro Antivirus 2009.lnk
%PROGRAMFILES%\MicroAV\


[-HKEY_CURRENT_USER\Software\AntiVirus]
[-HKEY_CURRENT_USER\Software\uav]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

%PROGRAMFILES%\uav\
%DESKTOP%\Ultimate Antivirus 2008.lnk
%SYSTEM%\uav.cpl



Version 2.353 (September 20, 2008)


Added: o4Patch.exe tool to detect infected binaries.



Version 2.352 (September 16, 2008)


%SYSTEM%\users64.dat
%SYSTEM%\sysppu?.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\pr]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow]
"10"=-
"di"=-
"u1"=-
"lk1"=-



Version 2.351 (September 15, 2008)


O3 - Toolbar: Internet Service - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{144A6B24-0EBC-4D89-BF09-A06A718E57B5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{144A6B24-0EBC-4D89-BF09-A06A718E57B5}"=-


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusResponse Lab 2009 2.1.lnk
%STARTMENU%\VirusResponse Lab 2009 2.1.lnk
%STARTMENU%\Programs\VirusResponse Lab 2009 2.1\
%DESKTOP%\VirusResponse Lab 2009 2.1.lnk
%PROGRAMFILES%\VirusResponseLab2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusResponseLab2009]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusResponseLab2009]
[-HKEY_CURRENT_USER\Software\VirusResponseLab2009]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusResponseLab2009\VirusResponseLab2009.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusResponseLab2009\VirusResponseLab2009.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirusResponseLab2009"=-



Version 2.350 (September 14, 2008)


%SYSTEM%\algg.exe

O2 - BHO: (no name) - {CFEE97A3-4911-444D-8BE8-E243A23D3DE2} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}]

O3 - Toolbar: Internet Service - {0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87}"=-


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Lab 2009 2.1.lnk
%STARTMENU%\AntiVirus Lab 2009 2.1.lnk
%STARTMENU%\Programs\AntiVirus Lab 2009 2.1\
%DESKTOP%\AntiVirus Lab 2009 2.1.lnk
%PROGRAMFILES%\AntiVirusLab2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2A9759D-210A-0253-D944-8B76AC2B0D92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirusLab2009]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirusLab2009]
[-HKEY_CURRENT_USER\Software\AntiVirusLab2009]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AntiVirusLab2009"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AntiVirusLab2009\AntiVirusLab2009.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AntiVirusLab2009\AntiVirusLab2009.exe"=-



Version 2.349 (September 11, 2008)


Update: IEDFix.C 1.3



Version 2.348 (September 09, 2008)


[-HKEY_CURRENT_USER\Software\AntiVirus]
[-HKEY_CURRENT_USER\Software\MicroAV]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

%SYSTEM%\MicroAV.cpl
%DESKTOP%\MicroAntivirus.lnk
%PROGRAMFILES%\MicroAntivirus\


[-HKEY_CURRENT_USER\Software\AntiVirus]
[-HKEY_CURRENT_USER\Software\XPA]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

%SYSTEM%\XPA.cpl
%DESKTOP%\XPert Antivirus.lnk
%PROGRAMFILES%\XPA\


[-HKEY_CURRENT_USER\Software\AntiVirus]
[-HKEY_CURRENT_USER\Software\PWA]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

%SYSTEM%\PWA.cpl
%DESKTOP%\Power Antivirus.lnk
%PROGRAMFILES%\PWA\


[-HKEY_CURRENT_USER\Software\AntiVirus]
[-HKEY_CURRENT_USER\Software\AAV]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

%SYSTEM%\aav.cpl
%DESKTOP%\Advanced Antivirus.lnk
%PROGRAMFILES%\AAV\


[-HKEY_CURRENT_USER\Software\AntiVirus]
[-HKEY_CURRENT_USER\Software\MSx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ANTIVIRUS"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ANTIVIRUS"=-

%SYSTEM%\MSx.cpl
%DESKTOP%\MS Antivirus.lnk
%PROGRAMFILES%\MSX\



Version 2.347 (September 08, 2008)


%SYSDIR%\c.ico
%STARTMENU%\VIP Casino.url
%FAVORITES%\VIP Casino.url
%DESKTOP%\VIP Casino.url

%WINDOWS%\mqgldfvo.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\YUR1.exe"=-
"\YUR2.exe"=-
"\YUR3.exe"=-
"\YUR4.exe"=-
"\YUR5.exe"=-
"\YUR6.exe"=-
"\YUR7.exe"=-
"\YUR8.exe"=-
"\YURA.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"\YUR1.exe"=-
"\YUR2.exe"=-
"\YUR3.exe"=-
"\YUR4.exe"=-
"\YUR5.exe"=-
"\YUR6.exe"=-
"\YUR7.exe"=-
"\YUR8.exe"=-
"\YURA.exe"=-

%DESKTOP%\BEST ZOO PORN.url
%DESKTOP%\QUALITY PORN.url
%SYSTEM%\YUR*.exe



Version 2.346 (September 05, 2008)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Antivirus-2009.lnk
%USERPROFILE%\Start Menu\Programs\Smart Antivirus 2009\
%DESKTOP%\Smart Antivirus-2009.lnk
%PROGRAMFILES%\Smart Antivirus 2009\


[-HKEY_CURRENT_USER\Software\Smart Antivirus 2009]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Smart Antivirus-2009.exe"=-



Version 2.345 (September 03, 2008)


Update: some malwares definitions and reboot.exe counter.


%SYSTEM%\Cpl32ver.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cpl32ver"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Somefox]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Somefox"=-


%DESKTOP%\System Antivirus 2008.lnk
%PROGRAMFILES%\sav\

[-HKEY_CURRENT_USER\Software\AntiVirus] (Already removed)
[-HKEY_CURRENT_USER\Software\SAV]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=- (Already removed)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=- (Already removed)



Version 2.344 (August 31, 2008)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareExpert.lnk
%ALLUSERPROFILE%\Start Menu\Programs\AntiSpywareExpert\
%DESKTOP%\AntiSpywareExpert.lnk
%PROGRAMFILES%\AntiSpywareExpert\

[-HKEY_CURRENT_USER\Software\AntiSpywareExpert]
[-HKEY_CURRENT_USER\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiSpywareExpert"=-

%USERPROFILE%\Application Data\printer.exe
%USERPROFILE%\Application Data\temp.dll
%SYSTEM%\mcrupdate.exe
%SYSTEM%\npad.exe

%ProgramFiles%\altcmd\
O2 - BHO: BhoApp Class - {3EDBF8E9-3130-72C8-ED30-32A3DB08ED44} - C:\Program Files\altcmd\altcmd32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EDBF8E9-3130-72C8-ED30-32A3DB08ED44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3EDBF8E9-3130-72C8-ED30-32A3DB08ED44}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\adczaznsersgfm1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\adczaznsersgfm=]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoApp Class]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\altcompare]



Version 2.343 (August 30, 2008)


%ProgramFiles%\aspch\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1FAB6BD-4A34-47ce-82AF-50B16A6BE77E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ThreatWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ThreatWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\aspch]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E1FAB6BD-4A34-47ce-82AF-50B16A6BE77E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\aspch]
[HKEY_CURRENT_USER\Software\aspch]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\aspch\ASpCh.exe"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\aspch\ASpCh.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"aspch"=-



Version 2.342 (August 28, 2008)


%DESKTOP%\Total Secure 2009.lnk
%USERPROFILE%\Start Menu\Programs\Total Secure 2009.lnk
%ProgramFiles%\TotalSecure2009\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Total Secure 2009]
[-HKEY_CURRENT_USER\Software\TotalSecure2009]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TotalSecure2009"=-



Version 2.341 (August 28, 2008)


%ProgramFiles%\Power-Antivirus-2009\
%USERPROFILE%\Application Data\Power-Antivirus-2009\
%USERPROFILE%\Start Menu\Programs\Power-Antivirus-2009\
%desktop%\Power-Antivirus-2009.lnk

[-HKEY_CURRENT_USER\Software\Power-Antivirus-2009]


%ProgramFiles%\RichVideoCodec\ (Already removed)
%SYSTEM%\RichVideoCodec.dll (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\CodecBHO.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{e12b39a5-df4a-4f04-a85b-4ecf048e359f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a37b3779-e4f3-424c-a495-a60ea8063476}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b65c5ebd-0989-40b5-a2a0-84642539bf82}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E46194A9-C4B1-4C0F-A75E-E9C5BDED7874}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7309FD6-0FD0-459D-A5E8-27D7A23215F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B648A7F7-DD8F-4535-AFAD-CE5BA0E8320E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a37b3779-e4f3-424c-a495-a60ea8063476}]

[-HKEY_CURRENT_USER\Software\RichVideoCodec] (Already removed)



Version 2.340 (August 27, 2008)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\VIE2.exe"=-
"\VIE3.exe"=-
"\VIE4.exe"=-
"\VIE5.exe"=-
"\VIEA.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"\VIE2.exe"=-
"\VIE3.exe"=-
"\VIE4.exe"=-
"\VIE5.exe"=-
"\VIEA.exe"=-

%DESKTOP%\EXTREME FUCK.url
%DESKTOP%\TITS AND ASS.url
%SYSTEM%\1.ico
%SYSTEM%\2.ico
%SYSTEM%\VIEA.exe
%SYSTEM%\VIE5.exe
%SYSTEM%\VIE4.exe
%SYSTEM%\VIE3.exe
%SYSTEM%\VIE2.exe

%WINDOWS%\rvoelbxt.exe

O2 - BHO: (no name) - {0BD44AB1-76A7-4E05-92F4-4B065FE72BD6} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BD44AB1-76A7-4E05-92F4-4B065FE72BD6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0BD44AB1-76A7-4E05-92F4-4B065FE72BD6}]

O3 - Toolbar: Internet Service - {3BEBF2FE-7248-40E2-9752-8163EB6C4038} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BEBF2FE-7248-40E2-9752-8163EB6C4038}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3BEBF2FE-7248-40E2-9752-8163EB6C4038}"=-



Version 2.339 (August 21, 2008)


Release: AntiXPVSTFix v1.0 (Removes Antivirus XP 2008 infection)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"buritos"=-

%ALLUSERPROFILE%\Start Menu\Programs\Antivirus XP 2008\
%ALLUSERPROFILE%\Start Menu\Programs\Antivirus XP 2008.lnk
%AllUserDesktop%\Antivirus XP 2008.lnk
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk



Version 2.337 (August 18, 2008)


Update: 404Fix v1.3

%Desktop%\FETISH PICS.url

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"smile"=-



Version 2.337 (August 14, 2008)

Update: IEDFix.C 1.1

O2 - BHO: (no name) - {300CF5C9-F02D-4CB8-ABED-9C229DA56825} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}]

%SYSTEM%\scui.cpl
%ProgramFiles%\AV9\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
%USERPROFILE%\Start Menu\Programs\Antivirus 2009\
%desktop%\Antivirus 2009.lnk

%SYSTEM%\winsrc.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}]



Version 2.336 (August 13, 2008)


%WINDIR%\buritos.exe
%WINDIR%\karina.dat

%SYSTEM%\braviax.exe
%SYSTEM%\buritos.exe
%SYSTEM%\karina.dat
%SYSTEM%\winivstr.exe

Search and restore infected:
%SYSTEM%\drivers\beep.sys

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"braviax"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"braviax"=-

O20 - AppInit_DLLs: C:\WINDOWS\System32\karina.dat


%AllUserDesktop%\XPSecurityCenter.lnk
%ALLUSERPROFILE%\Start Menu\Programs\XPSecurityCenter\
%ProgramFiles%\XPSecurityCenter\
%SYSTEM%\_scui.cpl

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"XP SecurityCenter"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify"="0x00000000"
"FirewallDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[-HKEY_LOCAL_MACHINE\SOFTWARE\XP_SecurityCenter\]

[HKEY_CURRENT_USER\Control Panel\don't load]
"scui.cpl"=-
"wscui.cpl"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ForceClassicControlPanel"=-


%desktop%\Antivirus Master.lnk
%ProgramFiles%\AVM\
%SYSTEM%\avm.cpl

[-HKEY_CURRENT_USER\Software\AntiVirus]
[-HKEY_CURRENT_USER\Software\AVM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-


%desktop%\TheSpyBot.lnk
%USERPROFILE%\Start Menu\Programs\TheSpyBot\
%ProgramFiles%\TheSpyBot\

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TheSpyBot]
[HKEY_CURRENT_USER\Software\TheSpyBot]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TheSpyBot"=-



Version 2.335 (August 11, 2008)


tdssserv.sys Rootkit detection

%ProgramFiles%\IA\
%ProgramFiles%\Internet Antivirus\
%USERPROFILE%\Application Data\Internet Antivirus\
%ALLUSERPROFILE%\Desktop\Internet Antivirus.lnk
%ALLUSERPROFILE%\Start Menu\Programs\Internet Antivirus\

%USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iGSh.png
%USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iMSh.png
%USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iPSh.png
%USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iv.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Antivirus_is1]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"iv"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Internet Antivirus"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"3P_UDEC_IA"=-

%desktop%\GAY PORN.url
%desktop%\MASTURBATION VIDS.url
%ProgramFiles%\PCHealthCenter\

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\Win2.exe"=-
"\Win3.exe"=-
"\Win4.exe"=-
"\Win5.exe"=-
"\Win6.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"\Win2.exe"=-
"\Win3.exe"=-
"\Win4.exe"=-
"\Win5.exe"=-
"\Win6.exe"=-

%ProgramFiles%\VAV\
%desktop%\Vista Antivirus 2008.lnk

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-



Version 2.334 (August 09, 2008)


Update: 404Fix v1.2

O3 - Toolbar: Internet Service - {254B87BB-510D-41FA-A887-52C5FA9BE585} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{254B87BB-510D-41FA-A887-52C5FA9BE585}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{254B87BB-510D-41FA-A887-52C5FA9BE585}"=-

%SYSTEM%\ieupdates.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ieupdate"=-



Version 2.333 (July 31, 2008)


%ProgramFiles%\Applications\

O3 - Toolbar: Internet Service - {38BF827A-D7C5-46E1-A9A2-47B1B5BB5438} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38BF827A-D7C5-46E1-A9A2-47B1B5BB5438}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{38BF827A-D7C5-46E1-A9A2-47B1B5BB5438}"=-



Version 2.332 (July 28, 2008)


%ProgramFiles%\ASpyC\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F58FF278-2198-403b-9170-C95022A194C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ASpyC]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F58FF278-2198-403b-9170-C95022A194C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASpyC]
[-HKEY_CURRENT_USER\Software\ASpyC]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ASpyC"=-



Version 2.331 (July 22, 2008)


Update: Generic Renos Fix 1.16



Version 2.330 (July 19, 2008)


%SYSTEM%\ubpr01.exe
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wblogon"=-

O2 - BHO: ASCWarningBHO Class - {58472BC6-BEA3-42d4-8917-7A8BCB0711B5} - C:\Program Files\ASC 2.1\ASCWarning32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917-7A8BCB0711B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{58472BC6-BEA3-42d4-8917-7A8BCB0711B5}]

O2 - BHO: (no name) - {D46BEAA4-A304-40B3-A9DA-EC7F7F501F25} - C:\Program Files\Web Technologies\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}]

O3 - Toolbar: Internet Service - {65742936-8079-408B-9F3C-874B78030A72} - C:\Program Files\Web Technologies\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65742936-8079-408B-9F3C-874B78030A72}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{65742936-8079-408B-9F3C-874B78030A72}"=-



Version 2.329a (July 04, 2008)


%ProgramFiles%\ASC 2.1\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\asc]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\asc 2.1]
[-HKEY_CURRENT_USER\Software\ASC 2.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"asc32"=-



Version 2.329 (July 04, 2008)


%ProgramFiles%\RichVideoCodec\ (Already removed)
%SYSTEM%\RichVideoCodec.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\RichVideoCodec.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A85A2972-D35F-4089-86AE-83DFEF054E23}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35DA02A8-1D27-43EB-8088-3210521AA154}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B2DBC9D-7D49-48F4-8DDC-1B15415FF253}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{926A61C9-5C20-4583-ACA7-ACE21088816E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{11446072-F8F2-4C03-8A8A-D337AD2B13F2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BAF84F6B-038B-40E2-9688-1E3BF20988D8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0EF350A6-8AF0-40B5-ADE7-CB82FD02C3AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.VideoCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.VideoCodec.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.XMLDOMDocumentEventsSi.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.XMLDOMDocumentEventsSink]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{926A61C9-5C20-4583-ACA7-ACE21088816E}]
[-HKEY_CURRENT_USER\Software\RichVideoCodec]

O3 - Toolbar: Internet Service - {85BDD81D-31FD-4A6B-A73C-3955B128D2EC} - C:\Program Files\Web Technologies\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85BDD81D-31FD-4A6B-A73C-3955B128D2EC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{85BDD81D-31FD-4A6B-A73C-3955B128D2EC}"=-

O2 - BHO: (no name) - {E2090673-256B-4632-94EE-FEC7F551543C} - C:\Program Files\Web Technologies\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2090673-256B-4632-94EE-FEC7F551543C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E2090673-256B-4632-94EE-FEC7F551543C}]



Version 2.328 (June 19, 2008)


%STARTMENU%\Programs\LookForPorn\
%PROGRAMFILES%\LookForPorn\
[-HKEY_CURRENT_USER\Software\LookForPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LookForPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LookForPorn]

%SYSTEM%\CbEvtSvc.exe
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CbEvtSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CBEVTSVC]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CbEvtSvc]



Version 2.327 (June 18, 2008)


Update: Option 3 - Trusted zone

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer]
"SearchURL"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer]
echo "SearchURL"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"SearchMigratedDefaultURL"=-
"SearchMigratedDefaultName"=-
"SearchMigrated"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Use Custom Search URL"=dword:00000000
"SearchMigratedDefaultURL"=-
"SearchMigratedDefaultName"=-
"SearchMigrated"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}"=-
"DefaultScope"=-

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\w\]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\w\]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AntiSpyCheck 2.1\AntiSpyCheck 2.1.exe"=-



Version 2.326 (June 17, 2008)


%favorites%\Antivirus Scan.url
%startmenu%\Antivirus Scan.url
%desktop%\Antivirus Scan.url
%startmenu%\Online Spyware Test.url
%desktop%\Online Spyware Test.url

%WINDOWS%\pebgkxwq
%WINDOWS%\neltabxw.exe
%PROGRAMFILES%\Web Technologies\

O2 - BHO: (no name) - {A49E097A-D6EF-4B2F-8B0F-1230E998587F} - C:\Program Files\Web Technologies\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}]

O3 - Toolbar: Internet Service - {F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B} - C:\Program Files\Web Technologies\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B}"=-

[-HKEY_CURRENT_USER\Software\Web Technologies]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9989F1F6-70DE-4244-AC9F-6672983681A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9989F1F6-70DE-4244-AC9F-6672983681A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning32.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning32.WarningBHO.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\e405.e405mgr]

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpyCheck 2.1.lnk
%STARTMENU%\AntiSpyCheck 2.1.lnk
%STARTMENU%\Programs\AntiSpyCheck 2.1\
%DESKTOP%\AntiSpyCheck 2.1.lnk
%PROGRAMFILES%\AntiSpyCheck 2.1\

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiSpyCheck 2.1"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AUTORUN_VAL"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiSpyCheck 2.1.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyCheck 2.1]
[-HKEY_CURRENT_USER\Software\AntiSpyCheck 2.1]



Version 2.325 (June 15, 2008)


Update: IEDFix.C



Version 2.324 (June 13, 2008)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpyCheck 2.1.0.lnk
%STARTMENU%\AntiSpyCheck 2.1.0.lnk
%STARTMENU%\Programs\AntiSpyCheck 2.1.0\
%DESKTOP%\AntiSpyCheck 2.1.0.lnk
%PROGRAMFILES%\AntiSpyCheck\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FA7933-DC3E-403b-8D47-BB5E3F345A21}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF-70C1EDD8B2E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiSpyCheck.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56FA7933-DC3E-403b-8D47-BB5E3F345A21}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyCheck]
[-HKEY_CURRENT_USER\Software\AntiSpyCheck]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiSpyCheck 2.1.0"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AntiSpyCheck"=-



Version 2.323 (May 27, 2008)


New Componant: Policies.exe
This tool is run first (then it runs SmitfraudFix.cmd) to restore some policies that prevent command line execution.



Version 2.322 (May 17, 2008)


%HOMEDRIVE%\term.bat

%DESKTOP%\Advanced XP Defender.lnk
%DESKTOP%\Advanced XP Fixer.lnk
%DESKTOP%\SystemDefender.lnk
%PROGRAMFILES%\iSecurity\
%SYSTEM%\iSecurity.cpl
O20 - AppInit_DLLs: C:\WINDOWS\System32\iSecurity.cpl

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iSecurity applet"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"iSecurity"=-
"PreBootCheck"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8311E8F-E459-4D22-89B4-CB9DCF10A425}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8311E8F-E459-4D22-89B4-CB9DCF10A425}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iSecurity.mgr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iSecurity.mgr.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zip.plugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\iSecurity]

%WINDOWS%\Resources\RomRunOnce.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d0e28824-5afa-4c7f-8f5e-77efb856737f}]

%PROGRAMFILES%\IE Extensions\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CJ.cjmgr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CJ.cjmgr.1]



Version 2.321 (May 17, 2008)


%WINDOWS%\oadkxrts.exe
%WINDOWS%\epfg.exe



Version 2.320 (May 06, 2008)


%WINDOWS%\spwoqbmv.exe
%WINDOWS%\xbaqktfv.exe
%WINDOWS%\qadovnel.dll

VirusHeat 4.4.exe
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.4.lnk
%STARTMENU%\VirusHeat 4.4.lnk
%STARTMENU%\Programs\VirusHeat 4.4\
%DESKTOP%\VirusHeat 4.4.lnk
%PROGRAMFILES%\VirusHeat 4.4\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0DFBA66B-DB48-4292-831A-E7186D8A61AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46F309AE-9D11-4C10-9D20-2C084B1C8BCE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CB95561-AF37-4BBD-823C-1E355A744A43}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76157861-4996-4711-90E4-6D868B877B24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{81DA01DB-8100-4865-B9B0-A83F54378435}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{910EF37B-A486-41FC-8A1B-28C5581AB3AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6B2BC38-7F2A-4202-9B43-A28615727FEE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B11DA4C8-52DC-44A2-B21B-02BF7A93EB5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5ADBFCA-C6DE-4E5A-A2DA-70AA2933B696}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5AE5932-F1B3-45E4-842A-59EEA65B13A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA18BA7B-9567-4408-9B87-3D3990C3969E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D56509AB-9821-4DB0-BF2F-115159804140}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DFF203EA-222C-44FA-8B78-ED88B4587AA2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB22B708-E0D3-4FCE-800B-6DD0C5B30D42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1EA02F8-E536-4828-BFB7-3DE7FA4D4B09}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F6E18622-DFA8-4DBA-B05E-D3D147E16D44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{23624BD0-2A69-4F91-BE6A-9F1F22B72C13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.4.exe 4.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.4]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 4.4"=-



Version 2.319 (April 25, 2008)


%DESKTOP%\IE AntiVirus 3.2.lnk
%STARTMENU%\Programs\IE AntiVirus 3.2.lnk
%PROGRAMFILES%\IEAntiVirus
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE AntiVirus]
[-HKEY_CURRENT_USER\Software\IEAntiVirus]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"antispy"=-



Version 2.318 (April 24, 2008)


Update: VACFix definition

%WINDOWS%\wxvgsdbq.exe
%WINDOWS%\olgdqarf.exe



Version 2.317 (April 22, 2008)


Release: 404Fix v1.0
A new componant to detect and remove 404 Helper BHO



Version 2.316 (April 21, 2008)


%SYSTEM%\814810\
O2 - BHO: 814810 helper - {DC59D6DA-7CDE-4874-9F97-41C82C177069} - C:\WINDOWS\System32\814810\814810.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DC59D6DA-7CDE-4874-9F97-41C82C177069}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DC59D6DA-7CDE-4874-9F97-41C82C177069}]



Version 2.315 (April 18, 2008)


%SYSTEM%\892267\
O2 - BHO: 892267 helper - {25E0128D-AAFC-49FF-AB11-1F12C2FCC391} - C:\WINDOWS\System32\892267\892267.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25E0128D-AAFC-49FF-AB11-1F12C2FCC391}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25E0128D-AAFC-49FF-AB11-1F12C2FCC391}]



Version 2.314 (April 14, 2008)


%DESKTOP%\Malware Bell 3.2.lnk
%STARTMENU%\Programs\Malware Bell 3.2.lnk
%PROGRAMFILES%\MalwareBell
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware Bell]
[-HKEY_CURRENT_USER\Software\MalwareBell]



Version 2.313 (April 14, 2008)


%SYSTEM%\403445\
O2 - BHO: 403445 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\System32\403445\403445.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E654A16-4765-4EAA-94EC-D5A6578053A4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E654A16-4765-4EAA-94EC-D5A6578053A4}]



Version 2.312 (April 12, 2008)


Update: IEDFix Signatures



Version 2.311 (April 09, 2008)


%WINDOWS%\config.ini
%WINDOWS%\mywallpaper.bmp
%WINDOWS%\sysabmpmfr.exe
%WINDOWS%\sysahbecjh.exe
%WINDOWS%\sysatjsicj.exe
%WINDOWS%\sysavxjgdu.exe
%WINDOWS%\sysawechod.exe
%WINDOWS%\zysalwhkkw.exe
%WINDOWS%\zysaoxcjiy.exe
%WINDOWS%\zysapghucv.exe
%WINDOWS%\zysaxyczld.exe

[-HKEY_CURRENT_USER\Software\CrystalRealityCleaner]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{DD651081-A909-45ad-BD71-2335B0ADE043}"=- (Already removed)
"{9754B85A-3B34-4969-BE1F-CD03227E9470}"=- (Already removed)
"{7DD4A7AC-A3F1-4495-884A-7947C5B89108}"=-
"{2C70168B-97CE-4f31-B85D-1FEC5002721D}"=-
"{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}"=-



Version 2.310 (April 08, 2008)


%SYSTEM%\215651\
O2 - BHO: 215651 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\System32\215651\215651.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BC5E8C9-6EFF-4976-9A3C-D74148442CE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0BC5E8C9-6EFF-4976-9A3C-D74148442CE7}]


O3 - Toolbar: Internet Service - {51D81DD5-55B7-497F-95DB-D356429BB54E} - C:\Program Files\NetProject\wamdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51D81DD5-55B7-497F-95DB-D356429BB54E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{51D81DD5-55B7-497F-95DB-D356429BB54E}"=-



Version 2.309 (March 26, 2008)


dwltqnmx.exe

%SYSTEM%\299914\
O2 - BHO: 299914 helper - {47DF236B-7D10-4C01-9820-50C0D54E7841} - C:\WINDOWS\system32\299914\299914.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47DF236B-7D10-4C01-9820-50C0D54E7841}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{47DF236B-7D10-4C01-9820-50C0D54E7841}]

O2 - BHO: (no name) - {7C109800-A5D5-438F-9640-18D17E168B88} - C:\Program Files\NetProject\sbmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}]

%SYSTEM%\375013\
O2 - BHO: 375013 helper - {74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B} - C:\WINDOWS\System32\375013\375013.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B}]



Version 2.308 (March 24, 2008)


%WINDOWS%\sysqyzwud.exe
%WINDOWS%\config.ini
%WINDOWS%\sysscpmqn.exe
%WINDOWS%\syssngbeh.exe
%WINDOWS%\sysutrnez.exe
%WINDOWS%\syszweuas.exe
%WINDOWS%\xcbhwuq.exe
%WINDOWS%\xewuaqj.exe
%WINDOWS%\xfjzrby.dll
%WINDOWS%\xhbxcnv.exe
%WINDOWS%\mywallpaper.bmp

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"{B081DB1F-4EE6-4021-9DD4-8B300F0D636D}"=-
"{05CD0D77-4947-4a56-94FA-0DF0DC644D7B}"=-
"{DD651081-A909-45ad-BD71-2335B0ADE043}"=-
"{9754B85A-3B34-4969-BE1F-CD03227E9470}"=-



Version 2.307 (March 22, 2008)


%WINDOWS%\norlatmx.exe
%WINDOWS%\fmrcjmdc.exe



Version 2.306 (March 21, 2008)


%SYSTEM%\tdidrv32.sys

%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {DF47DD37-AC11-4A93-8E16-2B2364AF0897} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF47DD37-AC11-4A93-8E16-2B2364AF0897}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF47DD37-AC11-4A93-8E16-2B2364AF0897}]



Version 2.305 (March 16, 2008)


%USERPROFILE%\Application Data\?????.exe (Awola6 Dropper, Random filename)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Windows Adapter 5.1.3214"=-

%USERPROFILE%\Application Data\Awola6\
%STARTMENU%\Programs\Awola6\

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Awola6"=-

%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]



Version 2.304 (March 15, 2008)


%ALLUSERSTARTMENU%\Programs\Startup\msn_0803_upd041807.exe
%ProgramFiles%\tmp0.exe



Version 2.303 (March 14, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow]
"*.securewebinfo.com"=-
"*.safetyincludes.com"=-
"*.securemanaging.com"=-



Version 2.302 (March 14, 2008)


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {D4FEDE82-C500-4AA4-BB99-A4DAE5A65A46} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4FEDE82-C500-4AA4-BB99-A4DAE5A65A46}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4FEDE82-C500-4AA4-BB99-A4DAE5A65A46}]

%SYSTEM%\jdxah.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1b40d2ad-d237-4544-b1e1-0bf75bf8fcc0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1b40d2ad-d237-4544-b1e1-0bf75bf8fcc0}"="inoperable"

O2 - BHO: (no name) - {6860A44B-5D3E-433D-A7B5-D517F810D0E7} - C:\Program Files\NetProject\sbmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}]



Version 2.301 (March 09, 2008)


O4 - HKCU\..\Run: [Pest-Capture] C:\Program Files\PestCapture\PestCapture.exe
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pest-Capture"=-


%SYSTEM%\sysockeu.exe
%SYSTEM%\sysokuaw.exe
%SYSTEM%\sysodkcs.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"[1029BB4B-16A9-4E77-AA3D-96930BD68EEC]"=-
"[2177F056-0AA6-4D6C-A944-13F71F341C29]"=-
"[852EBF20-A95D-4F1F-B9C2-B2CD24350F3E]"=-


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F10DE2B-E923-4548-B524-4D9C5FA80777}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8F10DE2B-E923-4548-B524-4D9C5FA80777}



Version 2.300 (March 02, 2008)


%SYSTEM%\mgmrwmrv.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,



Version 2.299 (February 29, 2008)


Update: IEDFix.exe 1.5
O2 - BHO: Windows Media Player - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\wmpdxm.dll


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {03B902B1-9B25-4173-9468-56775C85A8D4} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03B902B1-9B25-4173-9468-56775C85A8D4}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B902B1-9B25-4173-9468-56775C85A8D4}



Version 2.298 (February 28, 2008)


Update: VAC Fix 0.5



Version 2.297 (February 27, 2008)


%ProgramFiles%\tmp???????.exe
%ProgramFiles%\antiviirus.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"antiviirus"=-

%WINDIR%\Installer\{c6e9c531-af10-4639-bcd8-21e3520441a1}\KbdBoot.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6e9c531-af10-4639-bcd8-21e3520441a1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"KbdBoot"=-

%WINDIR%\Installer\{29b1075d-6c05-4cda-83aa-24d3777753c9}\CheckDrv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29b1075d-6c05-4cda-83aa-24d3777753c9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"CheckDrv"=-

%WINDIR%\Installer\{ee12547f-4a79-494f-be6d-14fc2f037713}\PrxDrive.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee12547f-4a79-494f-be6d-14fc2f037713}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PrxDrive"=-

%WINDIR%\Installer\{1d64c57d-091f-4aa8-8bb6-06543a8bc431}\WinCD.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1d64c57d-091f-4aa8-8bb6-06543a8bc431}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WinCD"=-



Version 2.296 (February 23, 2008)


C:\WINDOWS\Installer\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}\RomAvp.dll
C:\WINDOWS\Installer\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"RomAvp"=-



Version 2.295 (February 23, 2008)


%WINDIR%\ptlg.exe
%SYSTEM%\ptlg.exe
%WINDIR%\sprmvr.exe
%WINDIR%\�IEXPLORE.EXE

Remove ptlg Service

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msptlg"=-


%DESKTOP%\SpywareRemover.lnk
%STARTMENU%\Programs\SpywareRemover\
%PROGRAMFILES%\SpywareRemover\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DEA7D6F2-B8AB-4BB1-9422-86DC0B0F30E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\F497E0474CEB5344881F2C415C9D1736]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F497E0474CEB5344881F2C415C9D1736]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E74CD248E0D574C45A52FE6888496A3F]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{DEA7D6F2-B8AB-4BB1-9422-86DC0B0F30E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DisabledBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\E74CD248E0D574C45A52FE6888496A3F]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07E0FCEBD42BCAF4DA6E95F920A401FA]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1BE82F9C43A7DB343BA14C4279932C11]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CDA2C4C86C554043A1880B057FBFEDA]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D00C99486D42224B9FA246AD3CC04E9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\71B0EAD83CAD5924AB8E2DB01B911761]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CF08193722DAB9C4AB3218602F23C1F2]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F47680D455FCC574D8F56727A9E694D5]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F497E0474CEB5344881F2C415C9D1736]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{740E794F-BEC4-4435-88F1-C214C5D97163}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DisabledRun]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DisabledUninstall]
[-HKEY_CURRENT_USER\Software\SpywareRemover]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareRemover"=-


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {A3D76B96-30B9-4DCC-9B3D-D12E31280D29} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3D76B96-30B9-4DCC-9B3D-D12E31280D29}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3D76B96-30B9-4DCC-9B3D-D12E31280D29}


%SYSTEM%\wbchha.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ee9f7cf5-cd49-4cd8-8ba6-1514e7a5c22c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ee9f7cf5-cd49-4cd8-8ba6-1514e7a5c22c}"="djuka"



Version 2.294 (February 22, 2008)


Update: VACFix 0.4

%WINDOWS%\fkxvkns.exe



Version 2.293 (February 21, 2008)

%WINDOWS%\764.exe
%WINDOWS%\7search.dll
%WINDOWS%\absolute key logger.lnk
%WINDOWS%\aconti.exe
%WINDOWS%\aconti.ini
%WINDOWS%\aconti.log
%WINDOWS%\aconti.sdb
%WINDOWS%\acontidialer.txt
%WINDOWS%\adbar.dll
%WINDOWS%\cbinst$.exe
%WINDOWS%\daxtime.dll
%WINDOWS%\default.htm
%WINDOWS%\dp0.dll
%WINDOWS%\eventlowg.dll
%WINDOWS%\fhfmm-Uninstaller.exe
%WINDOWS%\fhfmm.exe
%WINDOWS%\flt.dll
%WINDOWS%\hcwprn.exe
%WINDOWS%\hotporn.exe
%WINDOWS%\iexplorr23.dll
%WINDOWS%\ie_32.exe
%WINDOWS%\jd2002.dll
%WINDOWS%\kkcomp$.exe
%WINDOWS%\kkcomp.dll
%WINDOWS%\kkcomp.exe
%WINDOWS%\kvnab$.exe
%WINDOWS%\kvnab.dll
%WINDOWS%\kvnab.exe
%WINDOWS%\liqad$.exe
%WINDOWS%\liqad.dll
%WINDOWS%\liqad.exe
%WINDOWS%\liqui-Uninstaller.exe
%WINDOWS%\liqui.dll
%WINDOWS%\liqui.exe
%WINDOWS%\ngd.dll
%WINDOWS%\pbar.dll
%WINDOWS%\pbsysie.dll
%WINDOWS%\settn.dll
%WINDOWS%\spredirect.dll
%WINDOWS%\vxddsk.exe
%WINDOWS%\wbeCheck.exe
%WINDOWS%\wbeInst$.exe
%WINDOWS%\wml.exe
%WINDOWS%\xadbrk.dll
%WINDOWS%\xadbrk.exe
%WINDOWS%\xadbrk_.exe
%WINDOWS%\xxxvideo.exe
%SYSTEM%\ace16win.dll
%SYSTEM%\acespy\
%SYSTEM%\ESHOPEE.exe
%SYSTEM%\msole32.exe
%SYSTEM%\rxjddnvj.exe
%SYSTEM%\vxddsk.exe
%SYSTEM%\winfrun32.bin
%SYSTEM%\wml.exe
%PROGRAMFILES%\3721\
%PROGRAMFILES%\Accoona\
%PROGRAMFILES%\akl\
%PROGRAMFILES%\amsys\
%PROGRAMFILES%\e-zshopper\
%PROGRAMFILES%\p2pnetworks\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12F02779-6D88-4958-8AD3-83C12D86ADC7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bb936323-19fa-4521-ba29-eca6a121bc78}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Cleaning Userinit or deleting if empty

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Cleaning Userinit



Version 2.292 (February 19, 2008)


%SYSTEM%\txdkfh.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d9f6ce57-0718-4bd1-916f-5fb1f86911c2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d9f6ce57-0718-4bd1-916f-5fb1f86911c2}"="arborize"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.3.lnk
%STARTMENU%\VirusHeat 4.3.lnk
%STARTMENU%\Programs\VirusHeat 4.3\
%DESKTOP%\VirusHeat 4.3.lnk
%PROGRAMFILES%\VirusHeat 4.3\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0EC085A8-9818-43B7-B975-EC7555EDA4D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1A74C41C-0837-4FBE-BA50-621EB70F01CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{25297614-1B76-4C2C-82C6-62738AA0E8F0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37F89457-1208-4670-9245-58C62BD6D870}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45477032-ABD0-454D-9CE4-EA34C10322F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69E34747-0B27-4B30-AE20-1023BF29E246}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79BE5B3B-80B2-4B77-A042-EFC90F6E0DE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C0EC6BF-81B9-4FE0-9447-4ED29A36BF5D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7EBB34CF-1728-4136-A968-48F231DAD1B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{88DAA291-B413-4C46-B378-3BE66F65369E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{936A2F4A-53F8-4D2F-92AA-2F9DE889841C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AFCC3FA7-82A9-42D5-A405-78711E97A5D6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CC05A4A3-7B28-488F-AB02-6AAEDB86ACCF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E80114AA-6653-4952-9E97-5F1DC63BEE0F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9109A2A-432B-4ADD-A6FA-06BA22DCD2D9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FCA3958A-8D38-4D14-8B81-CCD7F68A8A01}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CBD02E9B-37EF-47D2-96B0-3ABBB2EB92BF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.3.exe 4.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.3]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 4.3"=-



Version 2.291 (February 19, 2008)


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {2C566C34-7D72-4DC1-9BBE-1121A76698F8} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C566C34-7D72-4DC1-9BBE-1121A76698F8}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C566C34-7D72-4DC1-9BBE-1121A76698F8}

%STARTMENU%\Programs\SearchVideo\
%Programs%\SearchVideo
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchVideo]
[-HKEY_CURRENT_USER\Software\SearchVideo]

%SYSTEM%\svxmhpz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67dc0736-075a-4647-95f5-d5421b838fed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{67dc0736-075a-4647-95f5-d5421b838fed}"="esperantido"



Version 2.290 (February 16, 2008)


%STARTMENU%\Programs\SearchPorn\
%Programs%\SearchPorn
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchPorn]
[-HKEY_CURRENT_USER\Software\SearchPorn]



Version 2.289 (February 14, 2008)


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {8BD4438C-2511-4B93-AD34-2BDCD0FF78D2} - C:\Program Files\Helper\1203020309.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BD4438C-2511-4B93-AD34-2BDCD0FF78D2}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8BD4438C-2511-4B93-AD34-2BDCD0FF78D2}


%STARTMENU%\Programs\ChristmasPorn\
%Programs%\ChristmasPorn
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChristmasPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ChristmasPorn]
[-HKEY_CURRENT_USER\Software\ChristmasPorn]


%SYSTEM%\eeioq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{917f93bf-6714-4e11-8982-59db2e0f88fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{917f93bf-6714-4e11-8982-59db2e0f88fc}"="epistylar"



Version 2.288 (February 12, 2008)


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Program Files\Helper\1202750081.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]



Version 2.287 (February 10, 2008)


%SYSTEM%\ofcpi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7265100a-17e1-41bf-bd08-63b95a25a9c3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7265100a-17e1-41bf-bd08-63b95a25a9c3}"="cured"

O2 - BHO: Sotfone Tracker Class - {10C52A42-DB8B-4ade-AA4A-CED6A8282B67} - C:\Program Files\Sotfone\1202480950.dll
%PROGRAMFILES%\Sotfone\ (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10C52A42-DB8B-4ade-AA4A-CED6A8282B67}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{499B8A53-5949-4625-A8BF-A4D934AFC9DA}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E85F6AA5-7A0C-49A5-9E5E-936FED62347D}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tracker.TrackerObj] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tracker.TrackerObj.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10C52A42-DB8B-4ade-AA4A-CED6A8282B67}]



Version 2.286 (February 10, 2008)


%PROGRAMFILES%\NetProject\
[-HKEY_CURRENT_USER\Software\NetProject]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Service]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"some"=- (Already removed)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Secure Browsing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"start"=- (Already removed)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81705D67-3F73-4983-859B-97D0922E5ABE}] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{81705D67-3F73-4983-859B-97D0922E5ABE}"=- (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Application]



Version 2.285 (February 9, 2008)


%SYSTEM%\wupeng.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Winupdate Engine"=-

%SYSTEM%\ssa.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0391AAD0-AB5A-4338-B6DC-BB8405EB1C58}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F5D238F-ACC6-4089-9487-E2CD74E54954}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8EB51E2D-5F1A-4473-BD53-9B353C19A5A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gln.GLNBho]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gln.GLNBho.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0391AAD0-AB5A-4338-B6DC-BB8405EB1C58}]


%SYSTEM%\febcbcfdcececacc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"passwordexpirywarninghash"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\febcbcfdcececacc]


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareCrush 3.7.lnk
%STARTMENU%\MalwareCrush 3.7.lnk
%STARTMENU%\Programs\MalwareCrush\
%DESKTOP%\MalwareCrush.lnk
%PROGRAMFILES%\MalwareCrush\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E4D71E45-94E1-A19A-A939-B7D2A756F719}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{28621188-61C7-4829-A54B-3B73D055E982}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3544568D-D586-4746-84B9-84C7706AD597}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F2A5211-53B6-4C07-9A6D-959BF989528F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{535841D3-F4E1-4D3A-B506-CBC7F4E14913}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58035C9E-9A00-42FE-8F38-B380704F8EBA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C6D3658-833B-4E33-8BF4-77C4173770CF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D1595CE-B92A-47C5-9CC3-AE11E5A9AAFA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{83481BE4-117A-4BB4-87B1-2B14528B64A7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{878BF64D-DA3B-417C-A957-19662D5331C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A5B98B5-6CC9-49D4-967C-BB6AAA04E7E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8C55CF0F-FD4A-4B03-9365-906B0BFA86CC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B216377D-994C-4555-B44F-35F64D586833}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2105722-4ECC-48E8-866A-BF166CA967C4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4585709-B01D-4EE5-9274-3E34EA56E4B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CCCC68A6-7114-423A-B9A5-7110EB925EDD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E04407F5-F6B9-495D-A767-4D860E42DBE2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A4C66FB-4B04-478C-B855-FCA385797DB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareCrush.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareCrush]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareCrush]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareCrush"=-



Version 2.284 (February 8, 2008)


Update: VACFix

%WINDOWS%\fsxloqf.exe

[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{81705D67-3F73-4983-859B-97D0922E5ABE}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{81705D67-3F73-4983-859B-97D0922E5ABE}"=-



Version 2.283 (February 8, 2008)


%SYSTEM%\iinqyl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27cb634d-c84e-4c00-9b53-f5523601dbad}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27cb634d-c84e-4c00-9b53-f5523601dbad}"="cariniana"


%SYSTEM%\wuuawkz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{747e1fbe-b70f-441d-bbca-6e536c04924a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{747e1fbe-b70f-441d-bbca-6e536c04924a}"="didact"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 3.9.lnk
%STARTMENU%\VirusHeat 3.9.lnk
%STARTMENU%\Programs\VirusHeat 3.9\
%DESKTOP%\VirusHeat 3.9.lnk
%PROGRAMFILES%\VirusHeat 3.9\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0979850F-6C3E-4294-B225-B3D3C4A6F2A1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BB2DA5F-B78F-44EA-BDA1-771CBE1DEC68}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A4E73C5-BA3C-4391-B7E5-FFE8D3BD6245}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{44A923CA-F430-4F85-9F84-5153ECDB882E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E6E21EC-9D72-4164-8A53-74786A467872}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{631E9E48-B066-43DA-92AC-6DADF61B173B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{65C1361C-E696-4AF0-9E21-81910193F352}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77DCE805-C8CE-48AA-A47F-BFA6CC7704B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D42769F-07D8-494D-AAB4-AA1652C541FA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1922071-390C-418D-916D-91209E95D286}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1F8CD95-CFB3-43D1-A956-63441CC058C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A63B46AD-96A7-4A2C-BD8F-8CD097E1593A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A65F98DD-2360-468C-B76E-B1B84C0D547C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE2AEED0-BE1B-4BA2-826E-20D1991081B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7F73787-6206-4BBA-BDC0-7CFA9940DBCB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E770F739-2968-4ED9-A63C-DC1938DC82A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CFAFA83C-855B-4E3D-92B9-A587995B675A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 3.9.exe 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 3.9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 3.9"=-



Version 2.282 (February 8, 2008)


Update: VACFix, IEDFix


%WINDOWS%\frplprg.exe


%PROGRAMFILES%\Helper\ (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F10587E9-0E47-4CBE-ABCD-7DD20B862223}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-ABCD-7DD20B862223}]



Version 2.281 (February 4, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{132E4218-F960-4E17-B3F6-0F05431D81C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{435DEA43-7D14-47F0-8223-B416BD296464}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82FC6E1B-7C32-4144-B95D-22D757327778}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D604E3C4-21ED-43D4-8CDF-759954DE7E88}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{132E4218-F960-4E17-B3F6-0F05431D81C6}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB41490A-2B8A-414F-BFFB-D3527364EE25}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19C93F79-69BC-4994-B6C6-8D9CCCD9C454}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CB7E3AA3-D273-428B-A0DD-579689D26EC1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bsdw]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AB41490A-2B8A-414F-BFFB-D3527364EE25}"=-


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1AEEDB2-C2BA-4F27-B591-44EA89388299}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3DD6CD4E-6AAA-44DC-A804-88EB672341D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE78CF65-D188-487A-9A39-5DBFC77BF015}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15EE94F8-5660-47F1-8358-0D386BC64247}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AEEDB2-C2BA-4F27-B591-44EA89388299}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FF6FACA-CFF7-499D-AB5B-8EEA9CE80739}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7AB01356-C318-4E73-998C-8E54C8EB5E64}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA97E13E-1DED-4851-B684-BAD36D8E29B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.brgk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5FF6FACA-CFF7-499D-AB5B-8EEA9CE80739}"=-


%SYSTEM%\ctfmona.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmona"=-


%PROGRAMFILES%\IECodec\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3F27B120-0DED-4701-85B4-4CC58D92534C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9D18326E-AD27-4757-8564-79929B2F6363}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45490C66-3E2A-46cb-880B-547D69157450}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECodec] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\IECodec] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VSCHelp]

[-HKEY_CURRENT_USER\Software\Classes\AppID\IECodec.DLL] (Already removed)
[-HKEY_CURRENT_USER\Software\Classes\AppID\{A45C8C0C-E056-4892-A589-E389355E1E31}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{45490C66-3E2A-46cb-880B-547D69157450}]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO] (Already removed)
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO.1] (Already removed)



Version 2.280 (February 3, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3D4A580B-E7C5-4FF1-BC30-C0EE8E043122}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7EC2CAD4-02C2-4E99-8C8B-0A235EA96848}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B69341AE-B50E-40FF-A407-8A6C6B9C6805}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{61F79A78-BC2E-476A-AB37-E5016C2269B1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D4A580B-E7C5-4FF1-BC30-C0EE8E043122}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB1966D0-076C-49FD-A0DE-E142EAE25C57}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE8FE16A-8EC4-4763-B1B8-C1FD49813A2E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE61A031-F76D-4F3C-8AC5-59DBC0372BB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bxgk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{BB1966D0-076C-49FD-A0DE-E142EAE25C57}"=-


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F05D6CDA-C88F-47A3-A264-A00B3EE1676C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BAE4E0D0-1EA3-43CE-ACF5-F157376F57A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E69B5A50-7137-473A-98EB-CC2F855044B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CCEDFB8D-8C05-4A8E-8226-BCBF107798DE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F05D6CDA-C88F-47A3-A264-A00B3EE1676C}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{673E33A6-D87B-40DC-B0DC-C9C5B8F5A461}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C5CF283-48AE-4961-8C07-379D18217E3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{91CCF0B9-7CB2-4070-ADFE-7C66D673E8EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bwos]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{673E33A6-D87B-40DC-B0DC-C9C5B8F5A461}"=-



Version 2.279 (February 3, 2008)


%STARTMENU%\Programs\XXXHoliday\
%PROGRAMFILES%\XXXHoliday\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XXXHoliday]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XXXHoliday]
[-HKEY_CURRENT_USER\Software\XXXHoliday]


%PROGRAMFILES%\Helper\1201990766.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F10587E9-0E47-4CBE-ABCD-7DD20B8622FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-ABCD-7DD20B8622FF}]

%PROGRAMFILES%\Sotfone\1201990769.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10C52A42-DB8B-4ade-AA4A-CED6A8282B85}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{499B8A53-5949-4625-A8BF-A4D934AFC9DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E85F6AA5-7A0C-49A5-9E5E-936FED62347D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tracker.TrackerObj]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tracker.TrackerObj.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10C52A42-DB8B-4ade-AA4A-CED6A8282B85}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MultiMedia Software]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\multimediaControls.chl]



Version 2.278 (February 2, 2008)


Added: VACFix.exe tool to remove VideoAccessCodec generic files & keys.



Version 2.277 (January 28, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Information Center]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8113B5DE-F7EB-4154-A311-497FB80D8BD0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8113B5DE-F7EB-4154-A311-497FB80D8BD0}"=-


O2 - BHO: SXG Advisor - {EF39E67B-8383-4A49-AAC6-29349FA7F623} - C:\WINDOWS\dntpkwodpx.dll
O3 - Toolbar: ekxdvft - {F25117E3-2A27-4A0C-88EE-D9307F678DD0} - C:\WINDOWS\ekxdvft.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF39E67B-8383-4A49-AAC6-29349FA7F623}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F25117E3-2A27-4A0C-88EE-D9307F678DD0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27DBACCC-358C-4C2A-98FB-C79AFD3691C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6A74AFE4-24A0-49E7-9FC9-2A603F486441}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8323182A-2264-4A99-B9F8-40F3A425FCD7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1385D09E-8B2D-45E1-B235-49E12B248AD5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A98CC268-6435-4453-8DB5-A31C3DEB74BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bwtn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF39E67B-8383-4A49-AAC6-29349FA7F623}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F25117E3-2A27-4A0C-88EE-D9307F678DD0}"=-


%WINDOWS%\fxtqdrl.exe
%WINDOWS%\agrlmvp.dll
%WINDOWS%\bmlvqkn.dll
O21 - SSODL: agrlmvp - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\agrlmvp.dll
O21 - SSODL: bmlvqkn - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bmlvqkn.dll



Version 2.276 (January 27, 2008)


O2 - BHO: SXG Advisor - {AF7FCB20-E32A-41D8-B2ED-BC1EA8C11E90} - C:\WINDOWS\dntpkwo???.dll
O3 - Toolbar: ekxdvft - {C87444C3-8B83-4A48-91DE-95F9A3D61070} - C:\WINDOWS\ekxdvft.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF7FCB20-E32A-41D8-B2ED-BC1EA8C11E90}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C87444C3-8B83-4A48-91DE-95F9A3D61070}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18788028-95D6-4315-80E5-ABC50E05B30C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46EBFEF3-EE46-4CCD-8566-F2D8AA3FAE8B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69B6FEFD-172B-4AB7-BC58-BE851921C80E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{789D7229-B05F-4627-A9A7-32B1690C5158}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7C4A844A-EAE0-4497-8035-18F531056C15}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.btod]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF7FCB20-E32A-41D8-B2ED-BC1EA8C11E90}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{C87444C3-8B83-4A48-91DE-95F9A3D61070}"=-

%WINDOWS%\ffvrdgt.exe
%WINDOWS%\dntpkwo???.dll
%WINDOWS%\ekxdvft.dll
%WINDOWS%\bgrlsmn.dll
%WINDOWS%\adsoowf.dll
O2 - BHO: SXG Advisor - {A2190857-2B7C-46E1-851B-F8919A2DE836} - C:\WINDOWS\dntpkwo???.dll
O3 - Toolbar: ekxdvft - {D7257984-3F99-4D51-87C6-4D5E111DEBA9} - C:\WINDOWS\ekxdvft.dll
O21 - SSODL: bgrlsmn - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bgrlsmn.dll
O21 - SSODL: adsoowf - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\adsoowf.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A2190857-2B7C-46E1-851B-F8919A2DE836}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7257984-3F99-4D51-87C6-4D5E111DEBA9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1258A10B-5AE3-45FB-B7A5-6CACF8E5B91F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{83B1D400-F36B-4D87-8B18-172DDED5D02F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0F229D7-ADA0-468A-98A6-1640440C1757}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{051BD7AE-DEA2-47FE-B2E7-9541500BF4D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B83F4525-ADF4-4711-BC51-11D7E07CA0F4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.blgx]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A2190857-2B7C-46E1-851B-F8919A2DE836}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D7257984-3F99-4D51-87C6-4D5E111DEBA9}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bgrlsmn"=-
"adsoowf"=-



Version 2.275 (January 27, 2008)


Update: IEDFix v1.3



Version 2.274 (December 19, 2007)


Update: IEDFix v1.1. The tool will now detected new generic files and registry keys/subkeys without updates.



Version 2.273 (December 19, 2007)


%WINDOWS%\pdswin.dll




Version 2.272 (December 18, 2007)


%WINDOWS%\binret.exe
%WINDOWS%\ttvbon???.dll
%WINDOWS%\leosrv.dll
%WINDOWS%\hjoqor.dll
%WINDOWS%\xcvwer.dll
O2 - BHO: BDEX System - {7875DBFF-6B8A-4B74-B8A2-E2DBF657CA03} - C:\WINDOWS\ttvbonfvm.dll
O3 - Toolbar: The leosrv - {14E52265-CCA3-4F78-A21B-88F4EE6E78C1} - C:\WINDOWS\leosrv.dll
O21 - SSODL: hjoqor - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hjoqor.dll
O21 - SSODL: xcvwer - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\xcvwer.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14E52265-CCA3-4F78-A21B-88F4EE6E78C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7875DBFF-6B8A-4B74-B8A2-E2DBF657CA03}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E9078DA-0C69-47B0-9637-2734104BD217}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8EBAAB89-A5CD-40C4-A0AB-3275317351D1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8AD62-3D64-4F7B-B24D-2C785AE5449B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{372685AA-9F61-43F5-BEBA-A60900E228EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5328D226-7057-4B06-9E4A-7829BFA7CA78}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\leosrv.bkwo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\leosrv.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7875DBFF-6B8A-4B74-B8A2-E2DBF657CA03}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{14E52265-CCA3-4F78-A21B-88F4EE6E78C1}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hjoqor"=-
"xcvwer"=-


%WINDOWS%\mscfg32.dll


%SYSTEM%\gnjsjc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c770fbc-cc2f-4acd-93e8-e6f0594307fd}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5c770fbc-cc2f-4acd-93e8-e6f0594307fd}"="cariniana"



Version 2.271 (December 17, 2007)


%WINDOWS%\websrc32.dll



Version 2.270 (December 17, 2007)


%SYSTEM%\cjuvwa.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0123eb75-964c-4cb3-b796-431cc9099570}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0123eb75-964c-4cb3-b796-431cc9099570}"="disgorging"

%WINDOWS%\corpol.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E330678D-C3B1-4AC1-AD7B-2F9CAC58F889}]



Version 2.269 (December 15, 2007)


%WINDOWS%\pmspl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38583F22-1B12-4893-9D7A-BD3FA2A114C7}]



Version 2.268 (December 14, 2007)


%SYSTEM%\wowlze.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{c0ca766d-060c-48e1-b536-205e321bd174}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c0ca766d-060c-48e1-b536-205e321bd174}"="geosphere"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtect 3.9.lnk
%STARTMENU%\VirusProtect 3.9.lnk
%STARTMENU%\Programs\VirusProtect 3.9\
%DESKTOP%\VirusProtect 3.9.lnk
%PROGRAMFILES%\VirusProtect 3.9\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7C9058D-0F9C-32C0-83B6-740DFD8A6726}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BD06CA9-D39D-470C-AD69-40B2D20ED44E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1FCE299D-2509-4156-8F35-737685DA33D6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{477C7CD6-CAAD-43F5-96FB-C8F0F580F7E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A878A6E-E373-4F79-9B72-F6E3B6573FA4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{559FB885-1610-4359-B22F-CE0A0C7B1220}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{582ECCC8-C5BC-4EC4-8B0A-40274533088F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7060E07A-79A7-492E-8716-685840C41D3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D93B305-D932-45FF-B484-B96BAF433B18}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90E25318-2612-48DB-AD52-4D64B1E79368}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91335813-BFA8-493C-9ED5-E76A4F65F093}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9A44471D-1B69-4834-881C-E8E85D198186}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A71C08E5-E038-4672-943F-B386DE479944}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B20B249C-97C3-43F4-A560-A2C5239FBC50}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BD94CBD6-0B47-4327-8192-23BA274F7FD3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F761F695-FD28-42D3-A669-C3FC8309A6F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE2D4E30-10F9-4F16-B2D9-4D7A02F0AF34}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D2F6E4C0-349A-4A64-A773-C14661D5A9E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtect 3.9.exe 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtect 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtect 3.9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtect 3.9"=-


O2 - BHO: (no name) - {69B98C68-D2B8-4A4E-9CB7-E85B6F3A7014} - C:\Program Files\Online Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69B98C68-D2B8-4A4E-9CB7-E85B6F3A7014}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69B98C68-D2B8-4A4E-9CB7-E85B6F3A7014}]


O3 - Toolbar: IE Custom Tools - {F2BADA0D-FD61-45EF-A994-64A073FD6613} - C:\Program Files\Online Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2BADA0D-FD61-45EF-A994-64A073FD6613}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F2BADA0D-FD61-45EF-A994-64A073FD6613}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{F2BADA0D-FD61-45EF-A994-64A073FD6613}=-


%PROGRAMFILES%\Helper\
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - C:\Program Files\Helper\mattsearch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}]



Version 2.267 (December 13, 2007)

Added: IEDFix.exe tool to remove IE Defender keys and BHO from registry.

%SYSTEM%\sysvideo32.dll



Version 2.266 (December 13, 2007)


%WINDOWS%\msvideo.dll
O2 - BHO: Video - {80590BC5-F4BA-4AD1-B216-C19EE86E2A77} - C:\WINDOWS\msvideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\msvideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msvideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]



Version 2.265 (December 12, 2007)


%WINDOWS%\windivx.dll
O2 - BHO: Video - {F5E81149-92B2-47D2-A12B-1B966AB46EA7} - C:\WINDOWS\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]



Version 2.264 (December 12, 2007)


%WINDOWS%\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]



Version 2.263 (December 11, 2007)


%WINDOWS%\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{BC462E4B-C520-4CA9-B1EC-A7DD36FD6D0A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BC462E4B-C520-4CA9-B1EC-A7DD36FD6D0A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BC462E4B-C520-4CA9-B1EC-A7DD36FD6D0A}]



Version 2.262 (December 11, 2007)


%WINDOWS%\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]



Version 2.261 (December 11, 2007)


%WINDOWS%\jokvip.exe
%WINDOWS%\blopenv???.dll
%WINDOWS%\retnsrp.dll
%WINDOWS%\nopzet.dll
%WINDOWS%\leorop.dll
O2 - BHO: OFK System - {29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A} - C:\WINDOWS\blopenvtlv.dll
O3 - Toolbar: The retnsrp - {5FCD26F2-55C1-40F3-838A-FB4FD8833A53} - C:\WINDOWS\retnsrp.dll
O21 - SSODL: nopzet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\nopzet.dll
O21 - SSODL: leorop - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\leorop.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FCD26F2-55C1-40F3-838A-FB4FD8833A53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A914309-35E8-4A15-A175-56F7C7631A5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4E7132F-BC0F-4464-81AC-25F677AA7500}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18A7928B-2F6D-4B65-8DBB-96579CE0702D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D2CF7C5-E65C-470A-86FE-56C68CF07CBD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31820FB5-5CBD-49FF-92AD-795165A01C92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D7FDFC0-2192-4150-B573-DEE0661876C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F48D75B5-D574-4059-8D6B-6FA61DC0EAE0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{88BB4245-F609-48CF-9C95-FAE9735037F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E8C85D6-5E9F-467B-896E-7127AED75504}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DD0501B8-8D05-446E-A510-EDCC0E43618D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\retnsrp.blos]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\retnsrp.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5FCD26F2-55C1-40F3-838A-FB4FD8833A53}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"nopzet"=-
"leorop"=-


%ProgramFiles%\IECodec\
O2 - BHO: IECodecBHO - {4507C219-24AA-4813-9561-A2003F9920C3} - C:\Program Files\IECodec\IECodec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA5EAB81-9E79-4751-8E06-3E68FF0CFFB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7C12A866-F10B-43B4-A9D0-8857C318AF17}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4507C219-24AA-4813-9561-A2003F9920C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\IECodec]
[-HKEY_CURRENT_USER\Software\Classes\AppID\IECodec.DLL]
[-HKEY_CURRENT_USER\Software\Classes\AppID\{9F264A67-6126-451A-8D14-D6EE64364CD0}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{4507C219-24AA-4813-9561-A2003F9920C3}]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO.1]



Version 2.260 (December 10, 2007)


%SYSTEM%\uglgs.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76fbb79c-2ec6-4962-a324-fd4362588e1c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{76fbb79c-2ec6-4962-a324-fd4362588e1c}"="graphologists"

%SYSTEM%\ncrjf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b87dcc7-9b89-4205-aa82-076b2a1edfe0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8b87dcc7-9b89-4205-aa82-076b2a1edfe0}"="caribi"

%SYSTEM%\tvtpwp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}"="eaton"

O2 - BHO: (no name) - {E8249E69-A809-4544-832F-64EB65747A92} - C:\Program Files\Online Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E8249E69-A809-4544-832F-64EB65747A92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8249E69-A809-4544-832F-64EB65747A92}]

O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}]



Version 2.259 (December 09, 2007)


%WINDOWS%\stream32a.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\stream32a.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D23D68-9E03-4FF0-8035-C6184C8784EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{60B18D81-366A-4156-83B9-CF310ED9A8B7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stream32a.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]


%WINDOWS%\vipext???.dll (Already removed)
O2 - BHO: OFK System - {014F04C1-4440-4901-9A39-D08B116C1BA0} - C:\WINDOWS\vipextgpk.dll
O3 - Toolbar: The voipwet - {476B38B7-6E7C-46B4-8080-F61ED0E814F2} - C:\WINDOWS\voipwet.dll (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{014F04C1-4440-4901-9A39-D08B116C1BA0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{476B38B7-6E7C-46B4-8080-F61ED0E814F2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7ADB274-7419-4788-906D-C880FBAD11B9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEEEB14B-DB9F-48BB-B56D-CCDA3B942592}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{209A3C3B-B2C9-4451-9DD8-7B1C585ACC8E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{25474AF2-E3DE-4E68-8DE8-0B0786735E01}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5846BDF0-1EBB-4112-B601-2DA11EEF610E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CE5A74B-1E8B-4FD5-8C10-F49A2092FF8A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF809BE5-B8E2-4CD1-92DB-68129F895A64}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{13FD02D1-7E01-4CEA-B81D-595847E04645}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4795C864-D705-4009-B0A2-5F432FE6B61B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5383337F-EEC2-4B25-9C42-8992B49C7AFA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.bmrl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1] (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{014F04C1-4440-4901-9A39-D08B116C1BA0}]




Version 2.258 (December 04, 2007)


%SYSTEM%\ymmzwd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{075a465d-0af2-4b79-8db3-2fda0fd8d74c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{075a465d-0af2-4b79-8db3-2fda0fd8d74c}"="arsenicism"

%SYSTEM%\zcwlnic.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d66c22b6-2217-4d1a-9a90-1a54de1fc706}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d66c22b6-2217-4d1a-9a90-1a54de1fc706}"="edgers"


%WINDOWS%\vipext???.dll
O2 - BHO: MSVPS System - {00A00BA9-9D58-4B56-8FC6-C280650A8BD7} - C:\WINDOWS\vipextpnk.dll
O3 - Toolbar: The voipwet - {167F6405-019D-4F32-8FBE-23B3C63CD8FD} - C:\WINDOWS\voipwet.dll
O21 - SSODL: jetctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\jetctrl.dll (Already removed)
O21 - SSODL: kopmet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\kopmet.dll (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A00BA9-9D58-4B56-8FC6-C280650A8BD7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{167F6405-019D-4F32-8FBE-23B3C63CD8FD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EB24324-3394-4C5F-B69C-744A74797952}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C37AC-F6DC-4C75-B61A-8F86BC5A9E9A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{133621C3-9F52-4497-A814-97D268F8CACE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{36009226-067D-47C0-A497-7B2E5D3FAF03}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63115489-CFBF-4B7F-8B2F-EC1811041239}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A98BEE2D-F5D8-4BBB-B041-077CEFF0CA41}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE58E4D5-E8E1-4F59-AC3F-6315810A7889}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{603C15E0-CC27-45BB-82FD-8B2B6143E574}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A930694-495D-4C93-A483-D72FEF0EF1CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EFD7B225-FD88-40C7-931F-1FEEA9585D5C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.bros]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1] (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A00BA9-9D58-4B56-8FC6-C280650A8BD7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{167F6405-019D-4F32-8FBE-23B3C63CD8FD}"=-



Version 2.257 (December 02, 2007)


%SYSTEM%\sysdivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\sysdivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609F107D-88EE-4D19-B56F-6C21A3E9DC1F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F94E2B67-3D7A-4F94-AF35-5BBEDAAD3AC4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sysdivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]


%WINDOWS%\nretcip.exe
%WINDOWS%\vipextoxn.dll
%WINDOWS%\voipwet.dll
%WINDOWS%\jetctrl.dll
%WINDOWS%\kopmet.dll
O2 - BHO: MSVPS System - {5EF40AC5-1BBE-4436-A9E3-F129C0D605D8} - C:\WINDOWS\vipextoxn.dll
O3 - Toolbar: The voipwet - {D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C} - C:\WINDOWS\voipwet.dll
O21 - SSODL: kopmet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\kopmet.dll
O21 - SSODL: jetctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\jetctrl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4C5B3552-E18F-45BE-BEA8-78ACEC1F2C6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF40AC5-1BBE-4436-A9E3-F129C0D605D8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D79308A2-F924-4CD6-A52A-158C68EF41F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{602F5204-5CD4-4160-9506-2CA8266FAC4D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60C84877-62D8-4996-88E5-BAF3D115F09F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AEA32A1-63D2-4DE6-A1F8-C2132972C15F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9924DC07-F8D2-4A19-A396-9871B55612D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B039EF74-B33F-468E-BE93-2A4F0D61DF59}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{212B4E0F-BEA8-4894-800D-2C7E2EF097AD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3DD88B10-20E4-4085-BB2C-5A58B49910A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5216FD0F-3915-4F95-95CF-4F09659F58C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.btgn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5EF40AC5-1BBE-4436-A9E3-F129C0D605D8}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"jetctrl"=-
"kopmet"=-


%WINDOWS%\oprevpfm.dll
O2 - BHO: MSVPS System - {3CE12841-9438-48A0-9DA9-D3D2D3D562CC} - C:\WINDOWS\oprevpfm.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CE12841-9438-48A0-9DA9-D3D2D3D562CC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CE12841-9438-48A0-9DA9-D3D2D3D562CC}]

%WINDOWS%\werbetpwg.dll (already removed)
O2 - BHO: MSVPS System - {7EB8B2AC-28EE-45F1-9834-418FC9D72DDF} - C:\Windows\werbetpwg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7EB8B2AC-28EE-45F1-9834-418FC9D72DDF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EB8B2AC-28EE-45F1-9834-418FC9D72DDF}]

%WINDOWS%\hdtip.dll (already removed)
O3 - Toolbar: The hdtip - {E3E087D3-CA1D-4ECA-9960-D85944C2554C} - C:\Windows\hdtip.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3E087D3-CA1D-4ECA-9960-D85944C2554C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E3E087D3-CA1D-4ECA-9960-D85944C2554C}"=-




Version 2.256 (November 26, 2007)


%SYSTEM%\ivrllc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b585105c-0e84-4ef0-9c6a-fbe134a72945}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b585105c-0e84-4ef0-9c6a-fbe134a72945}"="ineffulgent"


%SYSTEM%\PowerVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PowerVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F627A939-3F63-42E2-B77B-F733CB2439C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FADC335E-6A47-47EF-97B8-704C72D1E725}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerVideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]


O3 - Toolbar: IE Custom Tools - {EFAF6EA3-615D-4F83-8748-2F7A576FCEA6} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}=-



Version 2.255 (November 26, 2007)


%WINDOWS%\monhop.exe
%WINDOWS%\werbet???.dll
%WINDOWS%\hdtip.dll
%WINDOWS%\gormet.dll
%WINDOWS%\pmkret.dll
O2 - BHO: MSVPS System - {A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE} - C:\WINDOWS\werbetdqw.dll
O3 - Toolbar: The hdtip - {85B2F289-7128-4C5A-A330-F9FC01432D3A} - C:\WINDOWS\hdtip.dll
O21 - SSODL: gormet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\gormet.dll
O21 - SSODL: pmkret - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\pmkret.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F25839C-CB93-4394-A938-2194851C544F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85B2F289-7128-4C5A-A330-F9FC01432D3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9024FB63-4FBA-4A65-B607-5D13B76CF13F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19D21F2D-455C-4AAA-8DF0-58F3D76962B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D78A01B-FD57-464B-B5F2-BFC1702F26DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3A5ED75E-2562-4266-A85D-4D66E33C50FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B983DE8B-60CD-4F7F-B09A-F8A33B26845C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA978B5D-E354-47FD-9E95-ACE61FC665DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7AAFD5DA-55D0-4FAB-8AEF-9643707042F6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE73C3E4-88F7-41A0-AF79-87BE6826B8DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F7A3BB37-D5C6-4946-AF22-DFCF804C67AB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hdtip.bpnv]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hdtip.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{85B2F289-7128-4C5A-A330-F9FC01432D3A}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gormet"=-
"pmkret"=-


%WINDOWS%\oprevxlw.dll
O2 - BHO: MSVPS System - {27A5292F-0C87-4E81-A34E-3131DBFCE994} - C:\WINDOWS\oprevxlw.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27A5292F-0C87-4E81-A34E-3131DBFCE994}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27A5292F-0C87-4E81-A34E-3131DBFCE994}]

%WINDOWS%\bonsws.dll
O3 - Toolbar: The bonsws - {2181E54F-274D-48B7-9E51-BC374933CD24} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2181E54F-274D-48B7-9E51-BC374933CD24}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2181E54F-274D-48B7-9E51-BC374933CD24}"=-

%WINDOWS%\oprevgkx.dll
O2 - BHO: MSVPS System - {1658DABA-FC4C-46C6-BC48-246CFEA0C436} - C:\WINDOWS\oprevgkx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1658DABA-FC4C-46C6-BC48-246CFEA0C436}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1658DABA-FC4C-46C6-BC48-246CFEA0C436}]

O3 - Toolbar: The bonsws - {3FDA21ED-312C-44DD-9030-A2DC90FD1CCD} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3FDA21ED-312C-44DD-9030-A2DC90FD1CCD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3FDA21ED-312C-44DD-9030-A2DC90FD1CCD}"=-

%WINDOWS%\oprevnpx.dll
O2 - BHO: MSVPS System - {F675EED8-4A4B-4A11-801B-08297749B83D} - C:\WINDOWS\oprevnpx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F675EED8-4A4B-4A11-801B-08297749B83D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F675EED8-4A4B-4A11-801B-08297749B83D}]

O3 - Toolbar: The bonsws - {05E9894E-9C5F-454B-A6E1-7BEF518EC87E} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05E9894E-9C5F-454B-A6E1-7BEF518EC87E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{05E9894E-9C5F-454B-A6E1-7BEF518EC87E}"=-

%WINDOWS%\ddkret.dll
O21 - SSODL: ddkret - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\ddkret.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ddkret"=-

%WINDOWS%\nopctrl.dll
O21 - SSODL: nopctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\nopctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"nopctrl"=-

%WINDOWS%\sawkip.exe
%WINDOWS%\jokwmp.dll
O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BA27973-068D-4F85-BE84-1251E0B20FD3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6BA27973-068D-4F85-BE84-1251E0B20FD3}"=-

%WINDOWS%\popnetmtq.dll
O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A78E352-B1FA-4C18-9C48-96DD03979770}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A78E352-B1FA-4C18-9C48-96DD03979770}]

%WINDOWS%\rmvgor.dll
O21 - SSODL: rmvgor - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\rmvgor.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"rmvgor"=-

%WINDOWS%\sapnet.dll
O21 - SSODL: sapnet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\sapnet.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"sapnet"=-

O3 - Toolbar: The jokwmp - {AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34} - C:\WINDOWS\jokwmp.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34}"=-

%WINDOWS%\popnetkqw.dll
O2 - BHO: MSVPS System - {A4D00A75-F69A-49FD-9058-AB925712CCFF} - C:\WINDOWS\popnetkqw.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4D00A75-F69A-49FD-9058-AB925712CCFF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A4D00A75-F69A-49FD-9058-AB925712CCFF}]

%WINDOWS%\popnetnlf.dll
O2 - BHO: MSVPS System - {AEAAD087-D66D-4FA3-A366-8F47C32E9E5F} - C:\WINDOWS\popnetnlf.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEAAD087-D66D-4FA3-A366-8F47C32E9E5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEAAD087-D66D-4FA3-A366-8F47C32E9E5F}]



Version 2.254 (November 25, 2007)


%SYSTEM%\PowerVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PowerVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F627A939-3F63-42E2-B77B-F733CB2439C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FADC335E-6A47-47EF-97B8-704C72D1E725}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerVideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]


O2 - BHO: (no name) - {23B760D6-C98B-450B-9B32-26C7775CDF83} - C:\Program Files\Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23B760D6-C98B-450B-9B32-26C7775CDF83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23B760D6-C98B-450B-9B32-26C7775CDF83}]

O3 - Toolbar: IE Custom Tools - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70CC76D5-A4EE-4F25-9931-B109A63E298E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{70CC76D5-A4EE-4F25-9931-B109A63E298E}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{70CC76D5-A4EE-4F25-9931-B109A63E298E}=-

%SYSTEM%\bubbj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1817ab5d-25bf-4d5e-ba90-6e5fe658fc5f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1817ab5d-25bf-4d5e-ba90-6e5fe658fc5f}"="exegeses"

%SYSTEM%\ijftc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6a36d4a-1a41-4d0e-adf2-e797f230c20a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6a36d4a-1a41-4d0e-adf2-e797f230c20a}"="bigfeet"

%SYSTEM%\fftktmk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}"="doglike"

%SYSTEM%\moywh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}"="haeckel"

%SYSTEM%\ucmbegr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d653e105-3e53-480a-b129-54d957d174bb}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d653e105-3e53-480a-b129-54d957d174bb}"="groutiest"

%SYSTEM%\rldyt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0883848-1466-4470-a418-3fe7d36694b9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b0883848-1466-4470-a418-3fe7d36694b9}"="bemocked"



Version 2.253 (November 14, 2007)


%ProgramFiles%\RichVideoCodec

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtect 3.8.lnk
%STARTMENU%\VirusProtect 3.8.lnk
%STARTMENU%\Programs\VirusProtect 3.8\
%DESKTOP%\VirusProtect 3.8.lnk
%PROGRAMFILES%\VirusProtect 3.8\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7C9058D-0F9C-32C0-83B6-740DFD8A6726}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21688E5D-A895-4B60-B127-B76607420334}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{40E563B2-61B2-4215-819A-A7E24CF8AA3E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45FBEFBF-E8B6-44A5-B0A1-A143E1A74816}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5146B43E-B36D-4A2A-B617-CC05CC500150}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B8BED0F-5F18-4051-9908-C5C569A1AAE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63667718-EBF2-4CAB-B1E8-994D41589C24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{972F0BE3-976F-40B8-8EB4-88A25987416E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9F80EA2D-53CF-4AA5-A154-F4FBF1EF6A5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A35F8FAC-755D-4F90-A5D3-F7E18D9EB100}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C269F4C1-7558-4DFC-9FB6-4C149B482586}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE92A296-3142-493C-B64E-6ED73EAFB9AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7C0DF6C-91FF-48BD-AD98-E35769394138}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8EC2704-B249-4495-A7A4-A90857BDDF4D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D91E9F36-9E44-44AB-803C-0D941FDA7988}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E0757BDD-69BE-4C3F-AFC6-50D6524FA9B6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F2F8C877-B06C-4B5E-95E7-AACFC9E8219D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3B8E549E-0C73-4AAB-8939-5EA2ED102CC6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtect 3.8.exe 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtect 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtect 3.8]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtect 3.8"=-



Version 2.252 (November 10, 2007)


%WINDOWS%\qdertu.exe

%WINDOWS%\ipwypkmg.dll
O2 - BHO: MSVPS System - {7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2} - C:\WINDOWS\ipwypkmg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19A236AD-F37B-40A8-A11A-7E9ABFD56CB0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8955B427-6C0C-413E-A0A7-0DC2948ADA3D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE1A8EBF-5AC3-488E-8226-F38C167B6C5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2}]

%WINDOWS%\bonrep.dll (Already removed)
O3 - Toolbar: The bonrep - {2357FC16-D8FC-4BF6-AFCA-573F9BD52644}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2357FC16-D8FC-4BF6-AFCA-573F9BD52644}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0E1B3BA-3D8E-456B-BCC5-163B09308240}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F575BBB6-A0A5-42C1-8406-CEDC8579FD75}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7586FC82-2EF8-4731-BAE1-22607AC0CC4A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E317C0F8-81DD-4AE8-87C7-B575A64B3696}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02A78E77-525D-4AF0-A822-CD04678CD638}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B141181-E967-42FD-AD64-52F283E12AAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7B0446D3-68BB-4A03-B907-EEE372655460}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RichVideoCodec]

%WINDOWS%\advrepkon.dll
O2 - BHO: MSVPS System - {6BE306E6-555D-41B1-98FF-6453622F4F4B} - C:\WINDOWS\advrepkon.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BE306E6-555D-41B1-98FF-6453622F4F4B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6BE306E6-555D-41B1-98FF-6453622F4F4B}]

%WINDOWS%\advrepgds.dll
O2 - BHO: MSVPS System - {FC91E698-C4BA-4564-9B85-659E38FCE154} - C:\WINDOWS\advrepgds.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC91E698-C4BA-4564-9B85-659E38FCE154}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC91E698-C4BA-4564-9B85-659E38FCE154}]

%WINDOWS%\ipwypwpk.dll
O2 - BHO: MSVPS System - {1BD6031F-BD9B-4DDF-A164-1D3A6701F374} - C:\WINDOWS\ipwypwpk.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BD6031F-BD9B-4DDF-A164-1D3A6701F374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1BD6031F-BD9B-4DDF-A164-1D3A6701F374}]



Version 2.251 (November 10, 2007)


%SYSTEM%\VideoMP3.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\VideoMP3.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64130BE8-2B67-4A65-9CA5-1CC6948C1471}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E54D728-1FA3-4125-B468-C8B43C123E65}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoMP3.MP3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]

%SYSTEM%\fnczfh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6fddce1-36ae-41c1-87d3-f49e514273d4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6fddce1-36ae-41c1-87d3-f49e514273d4}"="citrinous"

%SYSTEM%\xovdzz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1977ce08-a38f-43db-a856-f4aa6122131b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1977ce08-a38f-43db-a856-f4aa6122131b}"="bothrops"

%SYSTEM%\vtewupi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{831b4681-6ab9-436c-b2f1-6139158e3a91}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{831b4681-6ab9-436c-b2f1-6139158e3a91}"="eulalia"



Version 2.250 (November 05, 2007)


O2 - BHO: (no name) - {D1BD315B-8706-4C47-B443-A0784865CD04} - C:\Program Files\Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1BD315B-8706-4C47-B443-A0784865CD04}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1BD315B-8706-4C47-B443-A0784865CD04}]

%WINDOWS%\advreprwd.dll
O2 - BHO: MSVPS System - {7A22D62B-562F-4D55-8B1E-3AAA6C2BA688} - C:\WINDOWS\advreprwd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A22D62B-562F-4D55-8B1E-3AAA6C2BA688}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A22D62B-562F-4D55-8B1E-3AAA6C2BA688}]

%WINDOWS%\advrepvto.dll
O2 - BHO: MSVPS System - {E6E59F48-7BF8-4BEE-B906-273526C25DA4} - C:\WINDOWS\advrepvto.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6E59F48-7BF8-4BEE-B906-273526C25DA4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E6E59F48-7BF8-4BEE-B906-273526C25DA4}]

%WINDOWS%\movctrlknq.dll
O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlknq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC546B33-036A-41DA-B1CC-C1D15659520E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC546B33-036A-41DA-B1CC-C1D15659520E}]

%WINDOWS%\ipwypktx.dll
O2 - BHO: MSVPS System - {9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E} - C:\WINDOWS\ipwypktx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27B9F7C0-3728-48DB-BEEE-FA1279B7E62C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC9A032C-651A-41C7-AA02-781AF6F0B132}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FB301567-C982-4C81-A21A-BDAF829299D0}]

%WINDOWS%\bonrep.dll
O3 - Toolbar: The bonrep - {6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86B93136-309C-4763-8F63-DD95DA7D4A91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bonrep.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bonrep.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F3EEF4B8-F62A-471A-8565-48BDF3BFE163}]

%PROGRAMFILES%\VideoAccessCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55C68B1E-8FE7-46FE-8269-FBDE29BF6300}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B98015-F9F4-4B36-A9D8-EE9BCA7C2AC6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C14EEF3C-32F1-47DF-AFE1-ED8EEC9F0C0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD2D9F83-5761-4291-B713-A2C5044DD722}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BCF3C064-B623-4934-A025-56F151FA3778}]

%WINDOWS%\neobus.dll
O21 - SSODL: neobus - {5D1C9A4F-438B-4C5C-BE66-FAAA08D4BF49} - C:\WINDOWS\neobus.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"neobus"=-

%WINDOWS%\kbdctrl.dll
O21 - SSODL: kbdctrl - {A3023D18-B93F-4892-B89B-56FB36382B8F} - C:\WINDOWS\kbdctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"kbdctrl"=-



Version 2.249 (November 05, 2007)


%SYSTEM%\eulbn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48a7a70a-e118-4506-a373-c9d4e8a212a1}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{48a7a70a-e118-4506-a373-c9d4e8a212a1}"="arturo"

%WINDOWS%\advrepnok.dll
O2 - BHO: MSVPS System - {CFF8726A-9262-441C-8163-C6371E9EDE47} - C:\WINDOWS\advrepnok.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF8726A-9262-441C-8163-C6371E9EDE47}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFF8726A-9262-441C-8163-C6371E9EDE47}]

%SYSTEM%\mp3avi.dll
O2 - BHO: Mp3 Video - {D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF} - C:\WINDOWS\system32\mp3avi.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\mp3avi.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mp3avi.MP3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]



Version 2.248 (November 04, 2007)


%SYSTEM%\bqrcr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2dcea392-ea10-4e6d-aba4-329ac377119c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2dcea392-ea10-4e6d-aba4-329ac377119c}"="brachypyramid"

%PROGRAMFILES%\EZVideo\
%STARTMENU%\Programs\EZVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EZVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EZVideo]
[-HKEY_CURRENT_USER\Software\EZVideo]

%SYSTEM%\a3gpcodec.dll
O2 - BHO: 3GP - {5D67E2E7-0C2B-4491-87C4-37F2AC6033D2} - C:\WINDOWS\system32\a3gpcodec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\a3gpcodec.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\a3gpcodec.a3GP]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]

%DESKTOP%\IE Defender 2.3.lnk
%STARTMENU%\Programs\IE Defender 2.3.lnk
%PROGRAMFILES%\IE Defender
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Defender]
[-HKEY_CURRENT_USER\Software\IEDefender]



Version 2.247 (November 03, 2007)


Update, due to legit software (XunLei, a Chinese downloader) , using the same CLSID as the infection, this one is not removed anymore:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB911-C5FA-486F-8334-57288578C627}]



%SYSTEM%\dx50codec.dll
O2 - BHO: RealMedia - {87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95} - C:\WINDOWS\system32\dx50codec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\dx50codec.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dx50codec.RealMedia]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95}]



%SYSTEM%\yneid.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41591d7f-9e25-4bd0-af53-9908fcf3a738}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{41591d7f-9e25-4bd0-af53-9908fcf3a738}"="complacential"



%PROGRAMFILES%\Image Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image Add-on]

O2 - BHO: (no name) - {43BF8E0C-886D-4103-8DDB-2DFE0E8A0168} - C:\Program Files\Image Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43BF8E0C-886D-4103-8DDB-2DFE0E8A0168}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{43BF8E0C-886D-4103-8DDB-2DFE0E8A0168}]



%WINDOWS%\bndsrpfn.dll

%WINDOWS%\advrepdow.dll
O2 - BHO: MSVPS System - {CF368FC4-3241-409B-B1D6-0EA4FE33A555} - C:\WINDOWS\advrepdow.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF368FC4-3241-409B-B1D6-0EA4FE33A555}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF368FC4-3241-409B-B1D6-0EA4FE33A555}]

%WINDOWS%\advrepgpd.dll
O2 - BHO: MSVPS System - {93205C3F-1221-43F4-847F-007C6A4CE9A5} - C:\WINDOWS\advrepgpd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93205C3F-1221-43F4-847F-007C6A4CE9A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93205C3F-1221-43F4-847F-007C6A4CE9A5}]

%WINDOWS%\sdrmod.dll
O3 - Toolbar: The sdrmod - {210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdrmod.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdrmod.ToolBar.1]

%WINDOWS%\hupsrv.dll
O21 - SSODL: hupsrv - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hupsrv.dll

%WINDOWS%\bindmod.dll
O21 - SSODL: bindmod - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bindmod.dll



%SYSTEM%\proper.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\proper.exe

%SYSTEM%\bronto.dll
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\System32\bronto.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D27987B8-7244-4DE0-AE10-39B826B492F1}]

%SYSTEM%\winter.exe
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\System32\winter.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\System32\winter.exe

%USERPROFILE%\StartMenu\Program\Startup\infos.exe
O4 - Startup: infos.exe

%AllUsers%\StartMenu\Program\Startup\autos.exe
O4 - Global Startup: autos.exe

%SYSTEM%\skuns.dat
O20 - AppInit_DLLs: C:\WINDOWS\System32\skuns.dat



Version 2.246 (October 31, 2007)


%SYSTEM%\XunLeiBHO_Now.dll
O2 - BHO: RealMedia - {0EEDB911-C5FA-486F-8334-57288578C627} - C:\WINDOWS\system32\XunLeiBHO_Now.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\XunLeiBHO_Now.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xunleiBHO_Now.XunLei]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB911-C5FA-486F-8334-57288578C627}]



Version 2.245 (October 30, 2007)


%WINDIR%\movctrlqtn.dll
O2 - BHO: MSVPS System - {24038BE3-4EF2-41E2-A603-4CE3BDD9E874} - C:\WINDOWS\movctrlqtn.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24038BE3-4EF2-41E2-A603-4CE3BDD9E874}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{24038BE3-4EF2-41E2-A603-4CE3BDD9E874}]

O3 - Toolbar: The nssfrch - {1699137C-B90E-4488-97BC-575C896C2B5C} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1699137C-B90E-4488-97BC-575C896C2B5C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1699137C-B90E-4488-97BC-575C896C2B5C}"=-

%WINDIR%\movctrlnkd.dll
O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{077F45D5-5CC9-4FC8-A7BB-9D79836A6066}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{077F45D5-5CC9-4FC8-A7BB-9D79836A6066}]

O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD}"=-

%WINDIR%\movctrlwxq.dll
O2 - BHO: MSVPS System - {90CF5384-7C70-4CD6-A30D-B2F14537B5C3} - C:\WINDOWS\movctrlwxq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90CF5384-7C70-4CD6-A30D-B2F14537B5C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90CF5384-7C70-4CD6-A30D-B2F14537B5C3}]

O3 - Toolbar: The nssfrch - {7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC}"=-



Version 2.244 (October 30, 2007)


%SYSTEM%\IntelVideo.dll
%SYSTEM%\sysinit32.exe
O2 - BHO: IntelVideoCodec - {04F7FAC5-F506-4F29-9094-9CB9144B192C} - C:\WINDOWS\system32\IntelVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IntelVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IntelVideo.IntelVideoCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]



Version 2.243 (October 29, 2007)


O3 - Toolbar: The nssfrch - {2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B}"=-

%SYSTEM%\tkosvv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{837d024d-e0fb-44e8-acb1-24ec2309c487}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{837d024d-e0fb-44e8-acb1-24ec2309c487}"="frumps"

%SYSTEM%\fwzozx.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{c74f7434-a6e7-46c3-bf60-62a005074fe5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c74f7434-a6e7-46c3-bf60-62a005074fe5}"="barysilite"

%SYSTEM%\fqgwiw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3aea41ad-3ce4-48d9-acab-be40ad329e40}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3aea41ad-3ce4-48d9-acab-be40ad329e40}"="curing"



Version 2.242 (October 26, 2007)


%PROGRAMFILES%\Video Add-on\
%PROGRAMFILES%\Video Add-on Setup\

O3 - Toolbar: IE Custom Tools - {6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}=-

O3 - Toolbar: IE Custom Tools - {062F3F8B-CB94-4D76-A98A-EF800A438F01} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{062F3F8B-CB94-4D76-A98A-EF800A438F01}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{062F3F8B-CB94-4D76-A98A-EF800A438F01}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{062F3F8B-CB94-4D76-A98A-EF800A438F01}=-

O3 - Toolbar: IE Custom Tools - {23ED2206-856D-461A-BBCF-1C2466AC5AE3} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23ED2206-856D-461A-BBCF-1C2466AC5AE3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{23ED2206-856D-461A-BBCF-1C2466AC5AE3}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{23ED2206-856D-461A-BBCF-1C2466AC5AE3}=-

O2 - BHO: (no name) - {B499D34E-58EF-4927-AB9F-7AF52B2C4C82} - C:\Program Files\Online Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B499D34E-58EF-4927-AB9F-7AF52B2C4C82}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B499D34E-58EF-4927-AB9F-7AF52B2C4C82}]


%SYSTEM%\ugbtna.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75a65a53-15c9-4a0c-bb40-a7ca8b24f544}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{75a65a53-15c9-4a0c-bb40-a7ca8b24f544}"="boardwalk"


%WINDIR%\bndsrfst.dll
%WINDIR%\bndsrsvk.dll
%WINDIR%\bndsrdkq.dll
%WINDIR%\bndsrgxt.dll
%WINDIR%\bndsrkwm.dll
%WINDIR%\bndsrtvd.dll
%WINDIR%\bndsrvnl.dll
%WINDIR%\bndsrwlq.dll
%WINDIR%\movctrlswd.dll
%WINDIR%\movctrlfqd.dll
%WINDIR%\ntspknlg.dll
%WINDIR%\ntspklqs.dll
%WINDIR%\ntspkfnd.dll

O2 - BHO: MSVPS System - {15272B08-F6FE-4E71-B2BD-A59AD23EBE3C} - C:\WINDOWS\bndsrfst.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15272B08-F6FE-4E71-B2BD-A59AD23EBE3C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15272B08-F6FE-4E71-B2BD-A59AD23EBE3C}]

O2 - BHO: MSVPS System - {05F79890-CFA6-4D53-87BC-2F390DA6645E} - C:\WINDOWS\bndsrsvk.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05F79890-CFA6-4D53-87BC-2F390DA6645E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05F79890-CFA6-4D53-87BC-2F390DA6645E}]

O2 - BHO: MSVPS System - {480598DD-AE28-48B7-82F7-6ADDA1AA6B66} - C:\WINDOWS\ntspknlg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{480598DD-AE28-48B7-82F7-6ADDA1AA6B66}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{480598DD-AE28-48B7-82F7-6ADDA1AA6B66}]

O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\WINDOWS\movctrlswd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64DE95E5-0A25-4DD9-A472-97BC1D419101}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64DE95E5-0A25-4DD9-A472-97BC1D419101}]

O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146-409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6EB10F79-5E53-4F76-B146-409EFCDCB957}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EB10F79-5E53-4F76-B146-409EFCDCB957}]

O3 - Toolbar: The netadv - {D1413F77-5B69-4562-84E1-78F997794E9D} - C:\WINDOWS\netadv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1413F77-5B69-4562-84E1-78F997794E9D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D1413F77-5B69-4562-84E1-78F997794E9D}"=-

O3 - Toolbar: The netadv - {899B0EF2-E0BE-41BA-BB41-0ABFB232813C} - C:\WINDOWS\netadv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{899B0EF2-E0BE-41BA-BB41-0ABFB232813C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{899B0EF2-E0BE-41BA-BB41-0ABFB232813C}"=-

%WINDOWS%\kthemup.exe
%WINDOWS%\nssfrch.dll
O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\nssfrch.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\nssfrch.ToolBar.1]

O21 - SSODL: hostctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hostctrl.dll
O21 - SSODL: hostctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hostctrl.dll
O21 - SSODL: hstsys - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hstsys.dll
O21 - SSODL: bxsbang - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bxsbang.dll
O21 - SSODL: ocgrep - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\ocgrep.dll



Version 2.241 (October 24, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusRay 3.8.lnk
%STARTMENU%\VirusRay 3.8.lnk
%STARTMENU%\Programs\VirusRay 3.8\
%DESKTOP%\VirusRay 3.8.lnk
%PROGRAMFILES%\VirusRay 3.8\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97C6E0E9-1D24-48CA-11E7-DC22C5308ABA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D723C81-2C9F-44DD-8F94-A2D3A06845E9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41FC2EBD-79F5-4FE0-8558-708DCB7FE255}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45DB217B-965D-4917-A653-C2A871534B4C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48A95844-A761-4D96-8191-0913D493823E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60FD2747-818B-4242-A041-4C1209F3D3A6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70F731FD-6C5F-4D46-A29C-6B97FABEF0D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77F6ABAA-C14B-4E0C-975E-0CFFA568B0BE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78AA9209-DED5-4F37-93A0-89FBEE57E4FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{869B656B-142E-47E6-B4F6-973D17E80BBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89F84A04-F5EF-4F4A-AF97-7DA43DD0371F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F9C1393-41D7-4BE1-8752-098BC97514D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9097FA96-8EFD-4D04-8024-C920AB56BBEA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ACD5D550-4481-4F05-B6D8-A78566BD81D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE096ECD-D62E-4B2D-BBA5-CBF9BFA4AB23}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DDA20808-84A0-48C3-902A-7E31FF47EA6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9C4CBEB-7BDF-47FF-8EDF-D72B50BB50EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1AE427B0-E3B7-4D2E-A6B9-36605B0F214E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusRay 3.8.exe 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRay 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusRay 3.8]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusRay 3.8"=-


%SYSTEM%\beahahl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb4c6870-721f-4989-9c90-8cbfa46d0298}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb4c6870-721f-4989-9c90-8cbfa46d0298}"="anomuran"

%SYSTEM%\dfrep.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab75cc7d-2751-4144-a278-5462d5a5884c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ab75cc7d-2751-4144-a278-5462d5a5884c}"="bokard"

%SYSTEM%\mxhfjy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7999c5e2-b500-4ba5-8e9a-99639eca65fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7999c5e2-b500-4ba5-8e9a-99639eca65fc}"="celtiberi"

%system%\gaaplp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2}"="forayer"

%SYSTEM%\nczupfw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6d478c6-7961-4fe9-be4b-e621dd640112}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6d478c6-7961-4fe9-be4b-e621dd640112}"="benzaldoxime"

%SYSTEM%\clbrcek.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12a8c4e6-06c8-4ab3-9274-a0cde148e3da}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{12a8c4e6-06c8-4ab3-9274-a0cde148e3da}"="inquisitionist"

%SYSTEM%\siiyal.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1adb94e-0dc6-487c-b274-981bee6301a1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e1adb94e-0dc6-487c-b274-981bee6301a1}"="armillifer"

%SYSTEM%\sttwrd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f0c5ef8b-f4bb-4612-9ea8-361fff3da3d5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f0c5ef8b-f4bb-4612-9ea8-361fff3da3d5}"="designers"

%SYSTEM%\rrtrit.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee6bd1ad-1992-4f2c-8ea2-edc6eee4548b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ee6bd1ad-1992-4f2c-8ea2-edc6eee4548b}"="eurymus"



Version 2.240 (October 10, 2007)


%WINDIR%\bndsrvqt.dll

%SYSTEM%\flirek.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34ec76b6-53c4-4686-822f-910c790683fb}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{34ec76b6-53c4-4686-822f-910c790683fb}"="evangeliarium"

%SYSTEM%\gdrtul.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a47e7ce0-263d-40aa-86bc-27c1f6433143}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a47e7ce0-263d-40aa-86bc-27c1f6433143}"="chinned"

%SYSTEM%\hteogat.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02e155c1-202c-43a5-a212-58bb67d4341c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{02e155c1-202c-43a5-a212-58bb67d4341c}"="bearlike"



Version 2.239 (October 06, 2007)


%SYSTEM%\fifzqip.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{16be3225-e902-4d2a-ac98-aab162796927}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{16be3225-e902-4d2a-ac98-aab162796927}"="ataxics"

%SYSTEM%\hymww.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79cdca21-5055-4cae-b609-e1685ef55cf7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{79cdca21-5055-4cae-b609-e1685ef55cf7}"="hydria"

%SYSTEM%\veptlh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92050ffb-b796-4146-ae27-7e5e1d93b8a8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{92050ffb-b796-4146-ae27-7e5e1d93b8a8}"="endopsychic"

%PROGRAMFILES%\WinMsg\

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sware"=-
"sclick"=-



Version 2.238 (October 06, 2007)


O2 - BHO: (no name) - {CFE15135-C591-4000-A55E-A50E5F9F82BC} - C:\Program Files\Online Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFE15135-C591-4000-A55E-A50E5F9F82BC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFE15135-C591-4000-A55E-A50E5F9F82BC}]

%WINDIR%\bndsronw.dll
%WINDIR%\wsremover.exe
%WINDIR%\netadv.dll

O2 - BHO: MSVPS System - {3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A} - C:\WINDOWS\bndsronw.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A}]

O3 - Toolbar: The netadv - {ABF529BE-6245-465A-BBD4-238C4EAB0F0A} - netadv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABF529BE-6245-465A-BBD4-238C4EAB0F0A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ABF529BE-6245-465A-BBD4-238C4EAB0F0A}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\netadv.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\netadv.ToolBar.1]



Version 2.237 (October 04, 2007)


Update: WS2Fix v1.1



Version 2.236 (October 03, 2007)


%WINDOWS%\svhjdsah.exe


%WINDOWS%\afxp.dll
%WINDOWS%\msvb.dll
%WINDOWS%\sysdx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msvb"=-
"sysdx"=-


%PROGRAMFILES%\Online Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Add-on]



Version 2.235 (October 01, 2007)


%WINDIR%\exploeee.exe
%SYSTEM%\explore.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DoNotDelete"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DoNotDelete"=-

O4 - Startup: info.exe
O4 - Global Startup: info.exe
O20 - AppInit_DLLs: C:\WINDOWS\System32\sulimo.dat
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\sulimo.dat"

%SYSTEM%\mvwqn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0f691d7-01bf-4fed-926c-7368034a45e3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e0f691d7-01bf-4fed-926c-7368034a45e3}"="barbican"


O2 - BHO: MSVPS System - {ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1} - C:\WINDOWS\div32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1}]



Version 2.234 (September 30, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirGear 3.8.lnk
%STARTMENU%\AntiVirGear 3.8.lnk
%STARTMENU%\Programs\AntiVirGear 3.8\
%DESKTOP%\AntiVirGear 3.8.lnk
%PROGRAMFILES%\AntiVirGear 3.8\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BC3AC5B-3BBB-9DBE-8166-EC650E3B9B48}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A0FC1A4-41D4-4793-9AC5-0B55CDC95AE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14F47CA3-2291-4B3E-9ED4-8C7E6AE80851}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2447284F-3590-4E8C-A869-049BD87CAD07}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38EEEF46-CA24-4ACA-A90D-540978DF7252}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D5E5AE1-5DED-4520-BDC2-B9292EA708CA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{409A05EF-1B48-4198-B6BF-993B8B52790C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{47A93011-1004-440C-9960-BD3B0348A7C2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50B388D5-4A80-4191-8BCC-5DD031D7F3EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58A1ACE6-0DBA-45D2-8154-E8253A7B87BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{73D25394-992F-43D1-BF92-48494CC0D1AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D2A83A4-0687-4704-937E-A29045826F77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A7FE54B2-B167-4017-BCCC-CF73B2F678E3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C183B073-2D7F-45BC-8967-80147CECEE45}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F6FDBF9A-19A7-4F0A-9F46-6F015A067B44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F90A7969-20A0-4257-B39D-9C73D64CE3B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA38F299-57F8-4FEB-9096-715460AE943C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE6AE29A-EB7D-4656-9418-26D5FCC9ADF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirGear 3.8.exe 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirGear 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVirGear 3.8]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVirGear 3.8"=-


%SYSTEM%\vzfhprk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95dde900-8bf3-428c-b9be-8345c9d194f7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{95dde900-8bf3-428c-b9be-8345c9d194f7}"="homeridae"


O2 - BHO: MSVPS System - {0D5227BF-0C5B-4EA8-833C-FE09F1496F39} - C:\Windows\div32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D5227BF-0C5B-4EA8-833C-FE09F1496F39}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D5227BF-0C5B-4EA8-833C-FE09F1496F39}]



Version 2.233 (September 29, 2007)


%PROGRAMFILES%\Online Video Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Video Add-on] (C:\Program Files\Online Video Add-on\uninst.exe)

O3 - Toolbar: IE Custom Tools - {41F6170D-6AF8-4188-8D92-9DDAB3C71A78} - C:\Program Files\Online Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41F6170D-6AF8-4188-8D92-9DDAB3C71A78}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41F6170D-6AF8-4188-8D92-9DDAB3C71A78}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{41F6170D-6AF8-4188-8D92-9DDAB3C71A78}=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Custom Tools]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Safety Features]

%SYSTEM%\ieffse32.dll
%SYSTEM%\regmod.exe
O2 - BHO: ieffse32.msdn_hlp - {C1C6426B-FB16-4123-ACBE-74D94FB0E663} - C:\WINDOWS\System32\ieffse32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1C6426B-FB16-4123-ACBE-74D94FB0E663}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ieffse32.msdn_hlp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1C6426B-FB16-4123-ACBE-74D94FB0E663}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\yggyfnhb]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"some"=-
"start"=-

%SYSTEM%\swqzdtj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{adf64b1b-c68c-4ce8-bb55-258b7b8b0f81}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{adf64b1b-c68c-4ce8-bb55-258b7b8b0f81}"="aldoa"

%SYSTEM%\vusxqm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5feba593-3e6d-4606-ae6e-0680501cd29e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5feba593-3e6d-4606-ae6e-0680501cd29e}"="cacomixls"



Version 2.232 (September 27, 2007)


Added: WS2Fix.exe

%SYSTEM%\laf1.dll
%SYSTEM%\laf1.ini
%SYSTEM%\laf2.dll
%SYSTEM%\laf2.ini
%SYSTEM%\laf3.dll
%SYSTEM%\laf3.ini
%SYSTEM%\laf4.dll
%SYSTEM%\laf4.ini
%SYSTEM%\laf5.dll
%SYSTEM%\laf5.ini



Version 2.231 (September 26, 2007)


O2 - BHO: (no name) - {D579A683-0CC7-4023-BAE7-0544D0D1DA3A} - C:\Program Files\Online Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D579A683-0CC7-4023-BAE7-0544D0D1DA3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D579A683-0CC7-4023-BAE7-0544D0D1DA3A}]


%WINDOWS%\mscore.dll
%WINDOWS%\drvsvp.dll
%WINDOWS%\msmduo.dll
%WINDOWS%\msmduo2.dll
%WINDOWS%\div32.dll
%WINDOWS%\mssql.dll
%WINDOWS%\syscore.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{428FA4A4-C8EC-427C-85DE-11C80F67893A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{428FA4A4-C8EC-427C-85DE-11C80F67893A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"drvsvp"=-
"msmduo"=-
"msmduo2"=-
"mssql"=-
"syscore"=-



Version 2.230 (September 26, 2007)


%PROGRAMFILES%\Online Image Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imageactivexobject.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Image Add-on] (C:\Program Files\Online Image Add-on\uninst.exe)
[-HKEY_CURRENT_USER\Software\Online Add-on]


%SYSTEM%\jrpkmgh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60dea04c-9817-4309-bfa2-f8a1766c3cd1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{60dea04c-9817-4309-bfa2-f8a1766c3cd1}"="haruspicy"



Version 2.229 (September 25, 2007)


Minor Bug correction in path retriever.


O2 - BHO: MSVPS System - {31CBB13B-244D-4C44-AED5-DCAD70F66281} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CBB13B-244D-4C44-AED5-DCAD70F66281}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31CBB13B-244D-4C44-AED5-DCAD70F66281}]



Version 2.228 (September 24, 2007)


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegedit"=-


O20 - AppInit_DLLs: C:\WINDOWS\System32\stdole32.dat
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\stdole32.dat"


%SYSTEM%\pluwue.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"

%SYSTEM%\zdhgsp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc25189b-1b13-4abe-900e-65e08bd961af}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cc25189b-1b13-4abe-900e-65e08bd961af}"="escalators"

%SYSTEM%\fwjgtk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6747456b-cea8-463d-ad2a-50d67ae73d30}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6747456b-cea8-463d-ad2a-50d67ae73d30}"="cakewalks"



Version 2.227 (September 21, 2007)


%SYSTEM%\lgaac.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{655560a9-3ca8-4509-9632-6abbef21426b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{655560a9-3ca8-4509-9632-6abbef21426b}"="andropogon"

%SYSTEM%\iheuv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27882a9f-8937-4ae4-87ab-ed669c8b6d7a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27882a9f-8937-4ae4-87ab-ed669c8b6d7a}"="bund"


O2 - BHO: MSVPS System - {60D3EC53-56A8-46A8-9D01-1AB64410665C} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60D3EC53-56A8-46A8-9D01-1AB64410665C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60D3EC53-56A8-46A8-9D01-1AB64410665C}]



Version 2.226 (September 19, 2007)


%SYSTEM%\vmlwp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4c4bc43-0974-4dec-a669-9f7bfcb3503d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d4c4bc43-0974-4dec-a669-9f7bfcb3503d}"="coexpire"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirGear 3.7.lnk
%STARTMENU%\AntiVirGear 3.7.lnk
%STARTMENU%\Programs\AntiVirGear 3.7\
%DESKTOP%\AntiVirGear 3.7.lnk
%PROGRAMFILES%\AntiVirGear 3.7\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BC3AC5B-3BBB-9DBE-8166-EC650E3B9B48}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{418985AE-4FE4-448D-83EE-238C887D8FC2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F251303-F8C4-44C3-A7C2-9E8A93C59322}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61840430-C7CF-43A0-9D49-3B3ED563FED1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64A8E3CA-AE17-4EB0-8C67-47D1103A5B6F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{765A8F7D-F57B-4601-A038-3F463A4D3193}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77E616D5-5DB4-4B6A-8BDA-2BE4103A9921}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8742F319-C916-4930-B781-1C148134C05C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{897F5CB6-C1C1-494E-8F17-972784193442}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2224C72-745E-4046-882F-1A48C9311D77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA500EFC-3C92-44C9-B1D6-7A7033343A50}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB5E9971-7086-4E6E-ADFA-BE9C685BE68B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD7CA0BC-693A-4AF9-B31A-60472248F761}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B2882CC2-0077-426B-916D-E0B9EA23A1B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE241504-6F15-49E4-847F-B4D7DA9EA8F9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1666E4E-45C8-462A-97FF-BFD5A103BFFA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD9A05E8-4A1E-45E6-B3B6-37CE20140278}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AF0C5CBA-52E1-4B29-A2DC-58D91D599612}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirGear 3.7.exe 3.7]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirGear 3.7] (C:\Program Files\AntiVirGear 3.7\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVirGear 3.7]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVirGear 3.7"=-



Version 2.225 (September 15, 2007)


O2 - BHO: MSVPS System - {ACD85107-9CF9-4C9E-B0B7-39940A0017C0} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ACD85107-9CF9-4C9E-B0B7-39940A0017C0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ACD85107-9CF9-4C9E-B0B7-39940A0017C0}]

%SYSTEM%\ddllup.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8ea5f37-7327-4923-9808-8fd3b6f0d529}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b8ea5f37-7327-4923-9808-8fd3b6f0d529}"="beers"

%PROGRAMFILES%\DirectAccess\
%STARTMENU%\Programs\DirectAccess\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DirectAccess]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectAccess] (C:\Program Files\DirectAccess\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\DirectAccess]



Version 2.224 (September 14, 2007)


%SYSTEM%\vvihh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b36d60c8-e1ce-464e-b74c-8128a627ef56}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b36d60c8-e1ce-464e-b74c-8128a627ef56}"="hyracina"


O2 - BHO: (no name) - {1C3C4699-B285-475F-BE47-0B26088CE876} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C3C4699-B285-475F-BE47-0B26088CE876}]


O2 - BHO: MSVPS System - {3CB70CC2-303F-4A6C-824D-013AE8CFDB6B} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CB70CC2-303F-4A6C-824D-013AE8CFDB6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CB70CC2-303F-4A6C-824D-013AE8CFDB6B}]




Version 2.223 (September 12, 2007)


O2 - BHO: MSVPS System - {695A94FD-15D0-4ED7-8F40-D2B3BDC42C15} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{695A94FD-15D0-4ED7-8F40-D2B3BDC42C15}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{695A94FD-15D0-4ED7-8F40-D2B3BDC42C15}]


%SYSTEM%\iklqcx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{de5ede53-9db0-422d-b32d-5c41c96d6f52}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{de5ede53-9db0-422d-b32d-5c41c96d6f52}"="heterotroph"

%SYSTEM%\kzpkwj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f39d0dee-b2f0-4591-9187-1cc39c1df98a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f39d0dee-b2f0-4591-9187-1cc39c1df98a}"="biisk"

%SYSTEM%\ddomv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9f5cb985-d4a4-49af-9185-133f956b5756}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9f5cb985-d4a4-49af-9185-133f956b5756}"="anthracosaurus"

%SYSTEM%\gkymhk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{903902a8-0691-460e-8351-24df3d425e9c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{903902a8-0691-460e-8351-24df3d425e9c}"="apdu"

%SYSTEM%\ayjhc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95a4b6d8-dcd9-453a-aedf-f5d10af2519a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{95a4b6d8-dcd9-453a-aedf-f5d10af2519a}"="cordiformis"

%SYSTEM%\osdjhjc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2b8cea1-c8a7-48e2-b2fd-89ae5c608fb8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e2b8cea1-c8a7-48e2-b2fd-89ae5c608fb8}"="disenfranchising"



Version 2.222 (September 11, 2007)


%SYSTEM%\systems.txt

O20 - AppInit_DLLs: C:\WINDOWS\System32\systems.txt
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\systems.txt"



Version 2.221 (September 06, 2007)


Added: VCCLSID.exe tool.
Removes ShellServiceObjectDelayLoad LeftOvers random CLSID (newmediacodec/videoaccesscodec infections):
O21 - SSODL: msmdev - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\msmdev.dll
O21 - SSODL: msmhost - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\msmhost.dll



Version 2.220 (September 05, 2007)


%WINDOWS%\nsduo.dll
%WINDOWS%\msmdev.dll
%WINDOWS%\msmhost.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88418AA3-16F5-4FC2-A9D8-90B1266DF841}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88418AA3-16F5-4FC2-A9D8-90B1266DF841}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msmdev"=-
"msmhost"=-


%SYSTEM%\muvdjo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{46f5a8b0-0b73-48c5-9e40-3c443a43c161}"="aht"

%SYSTEM%\tqcwm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2bb2b2d6-8b86-412e-acca-d656a8979b3e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2bb2b2d6-8b86-412e-acca-d656a8979b3e}"="fraternalism"



Version 2.219 (September 01, 2007)


%STARTMENU%\Programs\StartUp\autorun.exe
%ALLUSERSTARTMENU%\Programs\Startup\findfast.exe

%WINDIR%\shell.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe C:\WINDOWS\shell.exe"

O4 - HKLM\..\Run: [Printer] C:\WINDOWS\System32\printer.exe
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Printer"=-

%SYSTEM%\spoolvs.exe
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\System32\spoolvs.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Spoolsv"=-


%SYSTEM%\fyhwfc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc7cbb1b-2da6-4e7d-a1ea-bf6705dd0f8c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fc7cbb1b-2da6-4e7d-a1ea-bf6705dd0f8c}"="biltongs"



Version 2.218 (August 30, 2007)


%SYSTEM%\guxmhcd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fedff4ae-1302-4b8a-bda9-43b9f67b9749}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fedff4ae-1302-4b8a-bda9-43b9f67b9749}"="astronomically"

%SYSTEM%\kvfvw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc824bb2-d4b3-41f1-bba0-f8240e4cc495}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cc824bb2-d4b3-41f1-bba0-f8240e4cc495}"="glauke"


%SYSTEM%\hrum.txt
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\hrum.txt"


%FAVORITE%\Error Cleaner.url
%FAVORITE%\Privacy Protector.url
%FAVORITE%\Spyware&Malware Protection.url
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4CF814F-970F-405D-A42C-0CE06EB97373}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4CF814F-970F-405D-A42C-0CE06EB97373}]


O3 - Toolbar: Protection Bar - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - C:\Program Files\Video ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F06E2ABE-3A50-4079-BE25-FC100D9EAA25}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F06E2ABE-3A50-4079-BE25-FC100D9EAA25}"=-



Version 2.217 (August 26, 2007)


%SYSTEM%\mivmv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6625fc6c-731c-443a-b3f0-2c8c520a1766}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6625fc6c-731c-443a-b3f0-2c8c520a1766}"="anhydrase"

%SYSTEM%\zdwii.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fdde73c-273e-4e55-84dc-455de06e4866}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2fdde73c-273e-4e55-84dc-455de06e4866}"="amaretti"

%SYSTEM%\tiqmcx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22}"="athermancies"


%WINDOWS%\mxduo.dll
%WINDOWS%\wmpdev.dll
%WINDOWS%\wmphost.dll
%SYSTEM%\mxstat.exe

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D7BCC-9857-4C9E-823B-D04E72490A67}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{208D7BCC-9857-4C9E-823B-D04E72490A67}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wmpdev"=-
"wmphost"=-




Version 2.216 (August 23, 2007)


%SYSTEM%\fwrkqfl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6e886df7-914d-48f0-86b3-a5cf24385361}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6e886df7-914d-48f0-86b3-a5cf24385361}"="falsism"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\hadjajr.ini"

%SYSTEM%\hadjajr.ini
%SYSTEM%\gopa.exe



Version 2.215 (August 22, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.7.lnk
%STARTMENU%\VirusProtectPro 3.7.lnk
%STARTMENU%\Programs\VirusProtectPro 3.7\
%DESKTOP%\VirusProtectPro 3.7.lnk
%PROGRAMFILES%\VirusProtectPro 3.7\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{03F65A7B-6E49-4ACE-848B-4459DDBD3981}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15125718-D196-47C9-8FBF-9889C0C85D67}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21C40A12-3079-4A70-A715-8A44CE0DE829}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A3E745F-1EAE-441F-A5D5-E53C909CEEC1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F6A3DCF-D68F-4663-8C25-312BCDBE4D47}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48129B70-2F29-4DBA-A499-BEB1A1554E10}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{484E9A1B-C631-47F3-9BC0-F752CDAAFB9A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1886D5E-3508-4109-A8A0-F045AA86F3A3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2817460-5C53-4B41-8D01-D3EF255DD41E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AEEA2138-2168-449E-B995-B56612EEF65E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AEFD40BB-03E3-4C66-ABFB-B5720ACB833E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B9C7A624-88E3-4DFA-8D56-438B10BC0149}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D21FBDCE-EF01-417C-A1A1-C1EEDB8D5DB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBA2671E-29BF-42D8-B17E-AB5315CC73C5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F105F0C9-50E2-44FA-B3EC-92CA7BFE0C0D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F664EA90-9B91-4825-9B51-5635AC38CCA6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6D7F9517-F134-45E3-BF2E-73414FF15CA1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.7.exe 3.7]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.7] (C:\Program Files\VirusProtectPro 3.7\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.7]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.7"=-


%SYSTEM%\tmxxxh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70d17a5f-ef27-4295-90f5-20ad6f24834f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{70d17a5f-ef27-4295-90f5-20ad6f24834f}"="dizening"

%SYSTEM%\ccyszwl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}"="arachnodacty"

%SYSTEM%\igzxwrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18a8f76b-804b-4981-b87c-460699971a4b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{18a8f76b-804b-4981-b87c-460699971a4b}"="dataria"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\hrum323.txt"


Update: %SYSTEM%\vtr167.dll -> %SYSTEM%\vtr???.dll

O2 - BHO: IEHlprObj Class - {ABCDECF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\vtr???.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ABCDECF0-4B15-11D1-ABED-709549C10000}]



Version 2.214 (August 21, 2007)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\hanonvt.ini"

%SYSTEM%\hanonvt.ini
%SYSTEM%\vtr167.dll



Version 2.213b (August 19, 2007)

Correction of a minor bug (missing caracter } ) in
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}"=-



Version 2.213 (August 17, 2007)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{283A0EE3-2CC1-45AB-8207-B1D7B69C7F83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{283A0EE3-2CC1-45AB-8207-B1D7B69C7F83}]

%SYSTEM%\ryxrho.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d}"="archiblast"

%SYSTEM%\zkpssqa.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d1e5ca97-235e-4ff0-9b92-7543c9d61ff4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d1e5ca97-235e-4ff0-9b92-7543c9d61ff4}"="bosken"



Version 2.212 (August 14, 2007)


O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5DDE5591-A8AB-4897-93EF-1E4E943F85A7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5DDE5591-A8AB-4897-93EF-1E4E943F85A7}]

O3 - Toolbar: Protection Bar - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - C:\Program Files\Image ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}"=-

%SYSTEM%\vpccw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e758745e-b8aa-47ac-a652-6307ff5f3ebf}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e758745e-b8aa-47ac-a652-6307ff5f3ebf}"="counterclaim"



Version 2.211 (August 11, 2007)


%PROGRAMFILES%\Video iCodec\
%STARTMENU%\Programs\Video iCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Video iCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video iCodec]
[-HKEY_CURRENT_USER\Software\Video iCodec]


%SYSTEM%\eigbbb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4da240e-7525-404a-b366-f50a422376d8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c4da240e-7525-404a-b366-f50a422376d8}"="arouse"

%SYSTEM%\nexpegp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}"="electroosmoses"

%SYSTEM%\xtsyynm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a4029063-4fe3-422c-ac72-12905c09642a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a4029063-4fe3-422c-ac72-12905c09642a}"="clinker"

%SYSTEM%\fqdqs.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd0e4a1a-dbc2-48f7-9a6a-a41cac20bddc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cd0e4a1a-dbc2-48f7-9a6a-a41cac20bddc}"="heterostyly"



%WINDOWS%\duocore.dll
%WINDOWS%\wmpenv.dll
%WINDOWS%\wmpconf.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BABA5BDB-4EFF-48DB-B443-679651D37128}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoAccessCodec] (C:\Program Files\VideoAccessCodec\Uninstall.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VAC.Video]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47C54F02-1B28-45F1-AE46-B5CDFB6E7926}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{47C54F02-1B28-45F1-AE46-B5CDFB6E7926}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo] (C:\WINDOWS\main_uninstaller.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoPlugin]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7AF59C20-A1D8-4C1C-927A-99DD9F2A9E0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AF59C20-A1D8-4C1C-927A-99DD9F2A9E0B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wmpenv"=-
"wmpconf"=-



Version 2.210 (August 08, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.6.lnk
%STARTMENU%\VirusProtectPro 3.6.lnk
%STARTMENU%\Programs\VirusProtectPro 3.6\
%DESKTOP%\VirusProtectPro 3.6.lnk
%PROGRAMFILES%\VirusProtectPro 3.6\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A2C9DEF-83EB-4575-AD6C-2377FEFC5122}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{56943D7C-2283-4D73-B2B1-46173B4844B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71C9109D-EB8D-49B9-9211-1CBE8A25A9AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75F32B07-D45F-4D5B-9266-3863C65D5B29}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84037416-6A70-46E5-9216-CDCC7E2513E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94E14C33-2473-4185-9FA0-3D881BDB5C0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{95D963D7-86E3-434E-BFF6-FCDDEA5F9F24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9DC10DE5-5104-4554-ACA0-D9F2D146CD4C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A140FE51-3136-4E0D-AFDA-1313B30ADFEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B41DF4F9-0191-46E6-8107-16634FBC7F3C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE1C526E-CCCC-449C-A9CB-691B8C5E2769}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE465556-F79D-476F-9457-74E49F8F400A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8DFA789-47D3-4197-B187-23AE2D7DCF6A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E0277D0D-43C7-4ECA-B8C4-545A2E71485B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EA166DBF-EAC4-4D33-B48D-A40B8C8FDEC1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F0ED2F90-DE03-46AD-97C1-709E5A49422C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{40331B9F-75E5-4E1E-B511-5AA6638B9ADE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.6.exe 3.6]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.6] (C:\Program Files\VirusProtectPro 3.6\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.6]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.6"=-


%SYSTEM%\vophqmn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71aba09-d81a-4876-baa3-df133c1dfc48}\InProcServer32] (Already Removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e71aba09-d81a-4876-baa3-df133c1dfc48}"="helicoid" (Already Removed)

%SYSTEM%\fshqaln.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a9e875b-d032-45e4-8294-789fe3be5b19}] (Already Removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4a9e875b-d032-45e4-8294-789fe3be5b19}"="atrichia" (Already Removed)

%SYSTEM%\ktrxe.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af8bca8b-a9f1-471d-bdcd-caa14be2bdd9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{af8bca8b-a9f1-471d-bdcd-caa14be2bdd9}"="hemprich"



Version 2.209 (August 06, 2007)


%SYSTEM%\gusur.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f5f16ef-af9d-4fe6-8410-f0670b58979d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4f5f16ef-af9d-4fe6-8410-f0670b58979d}"="exultet"

%SYSTEM%\khtbpdl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c82e1789-207a-4b8a-806f-76b62dfac2a2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c82e1789-207a-4b8a-806f-76b62dfac2a2}"="hutlet"


%SYSTEM%\afqgda.exe
%SYSTEM%\printer.exe
%SYSTEM%\WinAvX.exe
%SYSTEM%\WinAvXX.exe
%SYSTEM%\atzrdada.dll
%STARTMENU%\Programs\StartUp\system.exe
%ALLUSERSTARTMENU%\Programs\Startup\autorun.exe

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableRegistryTools"=0x00000001
"DisableTaskMgr"=0x00000001

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinAVX"="C:\WINDOWS\System32\WinAvX.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoControlPanel"=0x00000001
"NoWindowsUpdate"=0x00000001

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinAVX"="C:\WINDOWS\System32\WinAvX.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe C:\WINDOWS\System32\printer.exe"



Version 2.208 (August 03, 2007)


%SYSTEM%\zpuwriz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{547aaa89-7e6b-42b4-b112-a64955f86a2a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{547aaa89-7e6b-42b4-b112-a64955f86a2a}"="adirondack"

%SYSTEM%\tkrsw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8b3850e-a22e-43ab-a15e-63f6e47db7e6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b8b3850e-a22e-43ab-a15e-63f6e47db7e6}"="clamourers"

%SYSTEM%\lrnjnzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4c46558-da01-4637-a85e-f1ccb1c7436a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e4c46558-da01-4637-a85e-f1ccb1c7436a}"="hyams"

%SYSTEM%\afzdbl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8068bf35-3711-4dce-a2f3-f008cecfe894}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8068bf35-3711-4dce-a2f3-f008cecfe894}"="araca"

%SYSTEM%\ugofuq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c704547b-26c0-4222-a034-81653c07b494}] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c704547b-26c0-4222-a034-81653c07b494}"="eperdument" (Already removed)

%SYSTEM%\gtawclv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71aba09-d81a-4876-baa3-df133c1dfc48}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e71aba09-d81a-4876-baa3-df133c1dfc48}"="enjoyment"

%SYSTEM%\vjxwnn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd2948f8-c949-464f-824a-6272608c739e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bd2948f8-c949-464f-824a-6272608c739e}"="criticalness"

%SYSTEM%\fdpzgi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1c6fd4e6-49ce-4178-875b-df70eac260c5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1c6fd4e6-49ce-4178-875b-df70eac260c5}"="aguilarite"

O2 - BHO: (no name) - {34E6F97C-34E0-4CE5-B92B-F83634BEDC01} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34E6F97C-34E0-4CE5-B92B-F83634BEDC01}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34E6F97C-34E0-4CE5-B92B-F83634BEDC01}]

%STARTMENU%\Programs\XXXAccess\
%PROGRAMFILES%\XXXAccess\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XXXAccess]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XXXAccess] (C:\Program Files\XXXAccess\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\XXXAccess]



Version 2.207 (July 24, 2007)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Messenger Service]

O2 - BHO: (no name) - {D61D7E1A-6613-49CA-B6F9-51DB248E209D} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D61D7E1A-6613-49CA-B6F9-51DB248E209D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D61D7E1A-6613-49CA-B6F9-51DB248E209D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Security Plug-in]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Secure Bar]


%SYSTEM%\wzhtjqo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}"="enlodgement"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.5.lnk
%STARTMENU%\VirusProtectPro 3.5.lnk
%STARTMENU%\Programs\VirusProtectPro 3.5\
%DESKTOP%\VirusProtectPro 3.5.lnk
%PROGRAMFILES%\VirusProtectPro 3.5\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00628C22-6886-439B-AA2E-3639367F02A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14B512A9-25CF-4C90-AE5F-418689DF0A8D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{39D23F6A-E2DE-4F5D-9118-ECDFAAE47E9C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B334543-06C2-4B5F-B7CB-8028A4570B39}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E79A538-7998-4BB7-B8A7-0E12243D7A99}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{42348314-FC64-4B2E-B314-3F872C321B87}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58BD1E88-EFEE-404E-BE17-DF639B57CB56}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64D947B2-5505-4347-80A5-E28EEBE38F2A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D3C0252-8850-440E-A386-4A0159C8A4DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9B8BE22F-B2BB-472B-8959-C0828C0ADDC7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CD68722-9A43-42E4-BD01-2DE85D9CB565}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A8502478-83BC-48DB-9937-6EEB77CED41E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF1B7AB6-9715-472D-B469-74DE8D030EB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEB46F7E-CF37-4E8F-BA48-D96F1A434224}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2315CDD-4F9A-4DDA-8671-252465FF0B5D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FF442B5E-B5C0-4469-85C8-4B0B2A579EE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CD3A8ECE-6016-469E-9964-C479F9157BCC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.5.exe 3.5]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.5] (C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.5]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.5"=-



Version 2.206 (July 22, 2007)


%WINDOWS%\sconf32.dll
%WINDOWS%\wmplayer.dll
%WINDOWS%\wmsound.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C014816-5BD4-4166-85EA-62FE05E517C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C014816-5BD4-4166-85EA-62FE05E517C3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wmplayer"=-
"wmsound"=-

%SYSTEM%\psndz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa55d551-9698-48ac-b639-9b00cf1a6ea0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fa55d551-9698-48ac-b639-9b00cf1a6ea0}"="grazable"

%SYSTEM%\cqsfk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cea2e5cd-e849-427b-80f0-59298caef1c4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cea2e5cd-e849-427b-80f0-59298caef1c4}"="convalescently"



Version 2.205 (July 20, 2007)


%WINDOWS%\soundplugin.dll
%WINDOWS%\sounddrv.dll
%WINDOWS%\xvideo.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85E659D3-E110-4CE7-9D99-416FD61A1720}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85E659D3-E110-4CE7-9D99-416FD61A1720}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"sounddrv"=-
"xvideo"=-


%SYSTEM%\cefrjsh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1c16871-b797-4ec7-bbee-83852379c390}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a1c16871-b797-4ec7-bbee-83852379c390}"="formicivora"

%SYSTEM%\onljweo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}] (Already Removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{33b8d257-07f6-4c06-8605-94bc21728635}"="discommodiousness" (Already Removed)

%SYSTEM%\yhjbbzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f29a27-2451-4314-a480-8d2481ce6c81}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{49f29a27-2451-4314-a480-8d2481ce6c81}"="cyk"

%SYSTEM%\vgibz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a9e875b-d032-45e4-8294-789fe3be5b19}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4a9e875b-d032-45e4-8294-789fe3be5b19}"="dustuck"

%SYSTEM%\wpchz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5889f7b0-3277-4266-b4bd-1bf2d394aee6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5889f7b0-3277-4266-b4bd-1bf2d394aee6}"="hydronephrosises"



Version 2.204 (July 13, 2007)


%SYSTEM%\surzzh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cfda6372-043c-48d2-ba3c-7bfe1cf71854}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cfda6372-043c-48d2-ba3c-7bfe1cf71854}"="inscenation"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.4.lnk
%STARTMENU%\VirusProtectPro 3.4.lnk
%STARTMENU%\Programs\VirusProtectPro\ (Already Removed)
%DESKTOP%\VirusProtectPro 3.4.lnk
%PROGRAMFILES%\VirusProtectPro 3.4\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A8C61AE-9639-4E4D-AF61-25B0CE935EAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0DF3EB27-E122-4E77-9481-D9332351B606}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BA582C8-6240-4DC4-BB8E-1B764134A47B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1F6BD5E9-CEBD-4EB8-94B5-9C4E9C219306}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3DE68A1C-09C2-4724-BB80-CB5AAFB96D99}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{720B32BB-73D5-4551-B743-986224487121}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A238C6-F6A8-41D3-90FD-95F31F02FB33}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76C8C569-C4B8-4E0C-AE87-E1166D7FE005}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79E77B74-D820-4E39-802F-084F9DDCE038}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F7AFA67-ADC0-4227-B799-34F7800EBC96}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C254C9C5-DE04-49F1-9FC1-72EF4F7F1F6C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA91A4F1-3DC6-4D10-8AE3-8545E86D9DB8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0E42329-DCA9-4825-B87D-04B789BBB169}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D92E0D32-8D1B-4B8B-AF26-0676C5158ADA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E082EF71-40AF-4A4E-B036-BB773F450B53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAB5EB70-E2F1-4ADA-B033-151A71B9AA3F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{795175C7-3F75-4F45-AB6C-4FFE32A85BCB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.4.exe 3.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.4] (C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.4]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.4"=-



Version 2.203 (July 12, 2007)


O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E26CEADA-67B0-4543-BE8B-307F00265118}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E26CEADA-67B0-4543-BE8B-307F00265118}]

%SYSTEM%\wfcof.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9af8f31b-b778-4413-b8ed-ae63a62e1f7d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9af8f31b-b778-4413-b8ed-ae63a62e1f7d}"="firstlings"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F4DB301-0698-4AF4-A8A2-473996DF425A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F4DB301-0698-4AF4-A8A2-473996DF425A}]




Version 2.202 (July 08, 2007)


%WINDOWS%\msddx.dll
%WINDOWS%\msqnx.dll
%WINDOWS%\qnxplugin.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4118A625-1B64-4ED1-A2E9-76DEC529D2D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4118A625-1B64-4ED1-A2E9-76DEC529D2D2}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msddx"=-
"msqnx"=-


%SYSTEM%\drivers\svchost.exe
%USERPROFILE%\svchost.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"autoload"=-
"autorun"=-


%SYSTEM%\myqlejy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98ca7898-6029-41ab-8f67-ea4f5e1afc22}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{98ca7898-6029-41ab-8f67-ea4f5e1afc22}"="biocomputing"



Version 2.201 (July 07, 2007)


%SYSTEM%\winntify.exe
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winnotify]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winnotify]

O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]

%SYSTEM%\xnvaogd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}"="coronally"

%SYSTEM%\lapmvzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fde1bd72-ca80-443f-9526-595337b73878}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fde1bd72-ca80-443f-9526-595337b73878}"="hieroglyphist"



Version 2.200 (July 03, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.3.lnk
%STARTMENU%\SpyLocked 4.3.lnk
%STARTMENU%\Programs\SpyLocked 4.3\
%DESKTOP%\SpyLocked 4.3.lnk
%PROGRAMFILES%\SpyLocked 4.3\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2BD02A28-2CE5-41E6-83DB-6763E671CB86}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D5D65CB-D4DE-46D9-985F-F80D9F34C979}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4249D82A-882F-467B-9AA3-DCC40078EA69}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4FBE506D-6726-42B5-ADB0-0B56AF0AEFB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54DA8FE1-16CC-4304-921D-88DD591884EA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6036EFF9-4750-435D-BA00-2E4971A17954}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67BFFC72-F133-4C2A-8C2C-EC9B46FFB80C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B619BBA-1BB8-47F4-85B2-AEEE204AFE3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8E02BA95-D9BC-4E9F-AE33-38DD988CC868}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90B449E1-A378-4DBB-BAE6-4F5492B954C4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{99D26682-D444-4106-B346-A31B25B315E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9A76871A-CBEB-479C-9984-253AEF6CB3E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9B11649A-0DA6-4581-9A17-9DA31AD7FD42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A7152573-FA25-4BEA-8026-1EC8A5205D11}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA7301E0-686C-4C7C-95B7-1B96D2ED1A61}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E831429A-73A3-44D4-8935-DEEC11216093}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A321A998-2771-4235-B458-6B09AF6463B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.3.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.3] (C:\Program Files\SpyLocked 4.3\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.3]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 4.3"=-


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{100B21CD-3B97-44FB-B1C0-EA6249E482E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100B21CD-3B97-44FB-B1C0-EA6249E482E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XVideo]


%WINDOWS%\avp.exe
%WINDOWS%\mgrs.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avp"=-
"smgr"=-



Version 2.199 (July 02, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.3.lnk
%STARTMENU%\VirusProtectPro 3.3.lnk
%STARTMENU%\Programs\VirusProtectPro\ (Already Removed)
%DESKTOP%\VirusProtectPro 3.3.lnk
%PROGRAMFILES%\VirusProtectPro 3.3\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D52BB09-465C-4AA4-9FBD-71D1690CAED3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{24998748-6E8A-40D1-AA97-E9952EE9ED18}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{287FFE0C-15D0-4BFD-BAA9-0582C6361BBB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45973D31-5CE3-4503-BC81-25E525119C48}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46D4D563-1C43-4CEE-AF98-471385F2BC42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5596A310-2E54-4B75-ADA3-7EE0AD10E228}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C17F7D3-8460-4488-84EB-986A38BEDD2D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71DF187C-DC99-4A35-BDB2-C099821A435D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{74DF3F5E-99D7-4F4D-81C3-95201D4CDA88}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91478017-FF82-4C5D-9FFF-7801F8D99CCC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9F9C8CF3-EB4A-4851-A4F6-2370F5BC79EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B1B9C911-CA24-4E1E-9F56-838486218327}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C78E49C0-AB82-4C79-A189-F1E34980643B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2A0598F-FBC4-4721-BC85-F75C0712C100}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7B2831E-A25A-430B-B3E3-3D414F9C4288}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EDC652FF-2EA2-4E46-8849-D9041B77B88E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{049FECE3-18C7-4023-A1BE-CFAA2C4EE387}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.3.exe 3.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.3] (C:\Program Files\VirusProtectPro 3.3\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.3]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.3"=-



Version 2.198 (July 02, 2007)


%SYSTEM%\pjgerka.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{596e4935-4d3b-4a3c-842d-2efd1b3de598}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{596e4935-4d3b-4a3c-842d-2efd1b3de598}"="hundi"

%SYSTEM%\rxqcpn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}"="coenosarc"

%SYSTEM%\xikor.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e7aff349-39e1-4a96-a13d-24983440b44a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e7aff349-39e1-4a96-a13d-24983440b44a}"="biographers"

%SYSTEM%\nuqjici.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94524218-9af3-4643-9687-cbc2880e54da}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{94524218-9af3-4643-9687-cbc2880e54da}"="fagging"

%SYSTEM%\zpeolvh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}] (Already Removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4688f900-0d0c-4788-b297-59cc10e70ccc}"="amberoids" (Already Removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E6CFDFE-79A8-421C-B854-04081690CE6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E6CFDFE-79A8-421C-B854-04081690CE6B}]



Version 2.197 (June 26, 2007)


%WINDOWS%\vpsnetwork.dll
%WINDOWS%\expro.dll
%WINDOWS%\vpssup.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1770FD6-A7CB-44DA-AD2C-692D2A2B521B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1770FD6-A7CB-44DA-AD2C-692D2A2B521B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"expro"=-
"vpssup"=-



Version 2.196 (June 26, 2007)


O2 - BHO: (no name) - {CDE8EAB9-CEF3-4885-B12F-26960A25C800} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE8EAB9-CEF3-4885-B12F-26960A25C800}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CDE8EAB9-CEF3-4885-B12F-26960A25C800}]

O2 - BHO: (no name) - {36ADA89D-2440-4DC4-820A-3A05E8630935} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36ADA89D-2440-4DC4-820A-3A05E8630935}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36ADA89D-2440-4DC4-820A-3A05E8630935}]

O3 - Toolbar: Protection Bar - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - C:\Program Files\Image ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00}"=-

%SYSTEM%\iauoi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ff419a8-1748-4ca7-99df-d269465b0e8b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9ff419a8-1748-4ca7-99df-d269465b0e8b}"="cornerer"

%SYSTEM%\igpfced.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bbe40fd-0416-4c3f-80ea-0c7ad5fb1aab}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8bbe40fd-0416-4c3f-80ea-0c7ad5fb1aab}"="crawley"

%SYSTEM%\cdwvhbf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3afa7405-68e8-4bdb-920e-0d506f552826}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3afa7405-68e8-4bdb-920e-0d506f552826}"="concise"

%SYSTEM%\gbjkog.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41eaa909-24be-4d24-877f-076a0576a6fd}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{41eaa909-24be-4d24-877f-076a0576a6fd}"="castigating"

%SYSTEM%\tczij.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}"="farrandly"

%SYSTEM%\iwwvh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9c0c879c-9091-45d1-807f-2adc37d7d6d6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9c0c879c-9091-45d1-807f-2adc37d7d6d6}"="breadthes"

%SYSTEM%\xedasn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{33b8d257-07f6-4c06-8605-94bc21728635}"="drays"

%SYSTEM%\dooep.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44e670f2-d57b-4815-a576-955d17dbbf2d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{44e670f2-d57b-4815-a576-955d17dbbf2d}"="cankered"

%SYSTEM%\afkvvy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4688f900-0d0c-4788-b297-59cc10e70ccc}"="bipinnatifid"

%WINDOWS%\ddesupport.dll
%WINDOWS%\msole.dll
%WINDOWS%\msdde.dll
%WINDIR%\main_uninstaller.exe (Already removed)
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49CF52D7-8D58-4E22-A874-AAD721F5B523}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{49CF52D7-8D58-4E22-A874-AAD721F5B523}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSDNS] (C:\WINDOWS\main_uninstaller.exe 1) (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WINSP] (C:\WINDOWS\main_uninstaller.exe 2) (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msole"=-
"msdde"=-



Version 2.195 (June 09, 2007)


Update: Generic Renos Fix 1.14

%SYSTEM%\yesgnhr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f396a67-f473-48c9-9950-636ce17e584e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6f396a67-f473-48c9-9950-636ce17e584e}"="hellenophile"

%SYSTEM%\xpuupdate.exe

O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Video ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF4E7A0C-E233-4906-B4C1-A404356541FF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DF4E7A0C-E233-4906-B4C1-A404356541FF}"=-

%WINDOWS%\wincom27.dll
%SYSTEM%\ext32inc.dll



Version 2.194 (June 09, 2007)


%SYSTEM%\gsrnxgh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c704547b-26c0-4222-a034-81653c07b494}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c704547b-26c0-4222-a034-81653c07b494}"="debugs"



Version 2.193b (June 08, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyCrush 3.1.lnk
%STARTMENU%\SpyCrush 3.1.lnk
%STARTMENU%\Programs\SpyCrush\ (Already Removed)
%DESKTOP%\SpyCrush 3.1.lnk
%PROGRAMFILES%\SpyCrush 3.1\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14D6736F-9918-46D2-A96B-75713158DC9C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{33220D50-BB09-4F83-ABC2-E94011D088B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35A2B3DD-3B38-4E9E-A547-6E459A6E91AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{472B58B5-B00C-4DC5-83ED-FE8185FFBCBE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CB98812-6071-4D01-BC87-7E2CECB9C248}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DBE72DB-B023-47C2-AB01-D2323AADFA5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60F366A1-5D3B-4D3E-ACE3-CB8C25474FF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{754E70B2-E0DF-45CE-9429-CCFE0DD7AEA5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7583195C-5F83-4AD6-82D1-3C2F553F93E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77CAC444-50CC-4E1C-955C-55E325360864}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7DF4D9FC-1B6F-4093-8BC7-6A0F750B59D8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91EF3AD8-9373-4B3F-AAF5-2984E3E34385}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAD385C7-7B45-43FC-BF4E-EABB990337FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EC2A49C8-5970-4DA5-B784-32CD8617B6B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F3FAE2B3-0961-40A7-94C7-67A28967BE58}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB65F713-07A1-404D-889A-5789E383AB02}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3C4CCBFA-2ADA-43F3-9A40-F729DD31EC5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyCrush 3.1.exe 3.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyCrush 3.1] (C:\Program Files\SpyCrush 3.1\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyCrush 3.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyCrush 3.1"=-



Version 2.193 (June 08, 2007)


%SYSTEM%\ckimzeb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5bf53d50-b1ec-47b6-a00a-0bd32baeb7ef}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5bf53d50-b1ec-47b6-a00a-0bd32baeb7ef}"="damkjernite"

%USERPROFILE%\Application Data\AdProtect NoSpam\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\ContraVirus 2.0.lnk
%STARTMENU%\ContraVirus 2.0.lnk
%STARTMENU%\Programs\ContraVirus\
%DESKTOP%\ContraVirus 2.0.lnk
%PROGRAMFILES%\ContraVirus\

%SYSTEM%\xpuupdate.exe

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ad-protect.EXE] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEControl.DLL] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\spamdet.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ToolBarNotifier.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6B677F1F-F86C-4757-BF24-7D865EF20639}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7C11C36C-2AE0-4489-9B09-A6129139D52D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DA1990B-9BCA-4c80-AEFB-11A40FA849F9}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C628512D-A058-4BD4-B47B-B036F45FA02B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BE8C6A5-A75F-4e33-89C3-18CC58A0B952}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{61877300-54DB-4746-BA42-03E03A2B269C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBBD3E11-D201-46C9-8471-091D33159287}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFCBB188-18E3-1DEB-59D5-BACE1CE655A4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7ABE914-B8CF-4602-9145-6BDAAEDA21AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBE5BEE8-F032-11DB-826A-C4BB56D89593}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6B4AB50-F423-4EE6-9839-B35DCFCDFA49}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA038DDD-0FE0-41f5-BA60-FC3660529E71}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{214345B8-BB69-498D-A168-29F58F15D806}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61877300-54DB-4746-BA42-03E03A2B269C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63321A5C-D8FE-432C-8D2F-61C0FC264320}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6B4AB50-F423-4EE6-9839-B35DCFCDFA49}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F51BC478-D997-4C56-988D-79D9EEAAD1EC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F82FD7D4-2EC8-40B3-A141-DE051C98DCE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD4DCB8B-C33A-4E70-A351-6FAB7E1071A4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{283ED043-D403-4808-BF28-FCDE29DCF1FB}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2C02E5FC-7FE3-4122-911F-829314FE9BBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{32BD20FD-41FD-47FB-9BC9-28DCBD7D55D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6B677F1F-F86C-4757-BF24-7D865EF20639}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DFCDA823-80C5-4F55-B328-7EFD4AFBD9A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEControl.IEExtension] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEControl.IEExtension.1] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCToolBand.SCToolBandObj]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCToolBand.SCToolBandObj.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ToolBarNotifier.Notifier]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ToolBarNotifier.Notifier.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ContraVirus.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBE5BEE8-F032-11DB-826A-C4BB56D89593}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContraVirus] (C:\Program Files\ContraVirus\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\ContraVirus]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\AdLoader]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Trace7]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell\1das]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell\dnl7]
[-HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\Addins\Ad-Protect.Addin.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EA038DDD-0FE0-41f5-BA60-FC3660529E71}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ContraVirus"=-
"Windows Updater Servc"=-



Version 2.192 (June 04, 2007)


Added: Rustock, xpdx driver detection

%SYSTEM%\pkjcoxq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1d3b05d-4dd9-468d-982e-c342f05436e5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e1d3b05d-4dd9-468d-982e-c342f05436e5}"="crowsteps"



Version 2.191 (June 03, 2007)


%SYSTEM%\ipmon.exe
O4 - HKLM\..\Run: [ipmon] ipmon.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ipmon"=-

%SYSTEM%\eeuydc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44e670f2-d57b-4815-a576-955d17dbbf2d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{44e670f2-d57b-4815-a576-955d17dbbf2d}"="auditioned"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.1.lnk
%STARTMENU%\SpyLocked 4.1.lnk
%STARTMENU%\Programs\SpyLocked 4.1\
%DESKTOP%\SpyLocked 4.1.lnk
%PROGRAMFILES%\SpyLocked 4.1\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D3F4979-14F0-4344-95F9-D019C75ED669}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1DEAC6D1-27B1-4804-8309-86F80E64D91F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21EE18CF-E24C-4AD8-A279-C34EEB5F18A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22489F95-AA2E-4DFE-A00C-4F5D0DFDAFD6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{273582F0-3C1E-4BFC-B2A4-8348AE47F717}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27491041-2CCB-4A37-9297-FB84134ECAD4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{464B2A01-EB39-4CF6-B6BB-6262776B79DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60DDD776-BD47-421A-9B75-C5965C1AAEB3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6C2AD1F2-670F-4096-9CF5-6FBEA48D2E38}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A45C94F8-E114-48EB-84C9-DE1B871E1A3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B48F25A0-49A8-46AE-B506-A789F8E91A51}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D3F81C5A-3A2D-464C-B617-289495AE52DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6BC961E-2230-4A37-B7DC-F311773C7DBE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F8681E4A-3B1B-46C5-9A0E-E4BDCD240A92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA08D9EC-0C7B-4C37-8D7A-E7837B997E90}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC51DED7-D056-45E5-A4FF-A308E2DECFA5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9F99FD1A-5C53-4B82-981A-92A0F587D59B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.1.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.1] (C:\Program Files\SpyLocked 4.1\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 4.1"=-



Version 2.190 (June 01, 2007)


%PROGRAMFILES%\PornoPlayer\
%STARTMENU%\Programs\PornoPlayer\

[-HKEY_CURRENT_USER\SOFTWARE\PornoPlayer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PornoPlayer]



Version 2.189 (May 30, 2007)


%PROGRAMFILES%\VideoPlugin\
%STARTMENU%\Programs\VideoPlugin\


%WINDIR%\ossmart.dll
%WINDIR%\pssms.dll
%WINDIR%\vpnconfig.dll
%WINDIR%\privacy_danger\ (Already removed)
%WINDIR%\main_uninstaller.exe (Already removed)
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{16789285-C094-4aa6-88B9-2BB9DC13A485}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp] (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{16789285-C094-4aa6-88B9-2BB9DC13A485}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ossmart"=-
"vpnconfig"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSDNS] (C:\WINDOWS\main_uninstaller.exe 1)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WINSP] (C:\WINDOWS\main_uninstaller.exe 2)



Version 2.188 (May 25, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.0.lnk
%STARTMENU%\SpyLocked 4.0.lnk
%STARTMENU%\Programs\SpyLocked 4.0\
%DESKTOP%\SpyLocked 4.0.lnk
%PROGRAMFILES%\SpyLocked 4.0\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}] (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.0.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.0] (C:\Program Files\SpyLocked 4.0\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 4.0"=-



Version 2.187 (May 25, 2007)


Added: xpdt driver detection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E99D4D0C-EB54-46AF-B62A-3AA1F31D53E5}"=-

%SYSTEM%\viuaoq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7058baa-49a4-40b7-95c2-eec95cdf51f3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d7058baa-49a4-40b7-95c2-eec95cdf51f3}"="infumate"



Version 2.186 (May 22, 2007)


%PROGRAMFILES%\Security Tools\

%SYSTEM%\indwvm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25b7d2fd-4f71-46d1-801a-7de323e4ec82}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{25b7d2fd-4f71-46d1-801a-7de323e4ec82}"="equiparant"



Version 2.185 (May 22, 2007)


%WINDIR%\mssmart.dll
%WINDIR%\vsmart.dll
%WINDIR%\wow.dll
%WINDIR%\wowsupport.dll
%WINDIR%\privacy_danger\
%WINDIR%\main_uninstaller.exe (Already removed)
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2724E072-19D0-486d-A819-9D914191AE92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E99D4D0C-EB54-46AF-B62A-3AA1F31D53E5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wow.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wow.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2724E072-19D0-486d-A819-9D914191AE92}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"mssmart"=-
"vsmart"=-



Version 2.184 (May 21, 2007)


Update: Generic Renos Fix 1.13



Version 2.183 (May 16, 2007)


%PROGRAMFILES%\Image ActiveX Access\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image ActiveX Access]

O2 - BHO: (no name) - {B8C5186E-EC37-4889-9C2E-F73649FFB7BB} - C:\Program Files\Image ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8C5186E-EC37-4889-9C2E-F73649FFB7BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8C5186E-EC37-4889-9C2E-F73649FFB7BB}]

%SYSTEM%\dtjby.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0c5a0fff-9164-493b-93e0-17446374e0a0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0c5a0fff-9164-493b-93e0-17446374e0a0}"="inflexive"



Version 2.182 (May 15, 2007)


%SYSTEM%\uimcu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6ad686b9-ab56-4ebc-a804-9f70b55b4577}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6ad686b9-ab56-4ebc-a804-9f70b55b4577}"="floripondio"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.9.lnk
%STARTMENU%\SpyLocked 3.9.lnk
%STARTMENU%\Programs\SpyLocked 3.9\
%DESKTOP%\SpyLocked 3.9.lnk
%PROGRAMFILES%\SpyLocked 3.9\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.9.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.9] (C:\Program Files\SpyLocked 3.9\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.9]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 3.9"=-



Version 2.181 (May 13, 2007)


%WINDIR%\msdn.dll
%WINDIR%\bandserv.dll
%WINDIR%\loader.exe (Already removed)
%WINDIR%\tlhelp.dll
%WINDIR%\iereport.dll
%WINDIR%\main_uninstaller.exe (Already removed)
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D76F06D4-1659-482d-BCB2-3F731BFE0941}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bandserv.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bandserv.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D76F06D4-1659-482d-BCB2-3F731BFE0941}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"tlhelp"=-
"iereport"=-



Version 2.180 (May 11, 2007)


%SYSTEM%\antzozc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa4fbf53-c766-4622-8011-a87a805eebf0}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fa4fbf53-c766-4622-8011-a87a805eebf0}"="deboner"

%PROGRAMFILES%\Protection Tools\
%PROGRAMFILES%\Video ActiveX Access\

O2 - BHO: (no name) - {7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8}]

O3 - Toolbar: Protection Bar - {31615D5C-5126-448A-818A-A7CDFEE85A9B} - C:\Program Files\Video ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31615D5C-5126-448A-818A-A7CDFEE85A9B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{31615D5C-5126-448A-818A-A7CDFEE85A9B}"=-



Version 2.179 (May 09, 2007)


%SYSTEM%\kgkdbsk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{735e980d-45d2-4777-af82-9923d3c8d3ae}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{735e980d-45d2-4777-af82-9923d3c8d3ae}"="heterandrous"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.7.lnk
%STARTMENU%\SpyLocked 3.7.lnk
%STARTMENU%\Programs\SpyLocked 3.7\
%DESKTOP%\SpyLocked 3.7.lnk
%PROGRAMFILES%\SpyLocked 3.7\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.7.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.6] (Already removed - C:\Program Files\SpyLocked 3.7\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.7]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 3.7"=-



Version 2.178 (May 09, 2007)


Added: DNS IP to detect: 194.54.x.x



Version 2.177 (May 08, 2007)


%SYSTEM%\egzcqg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ede8bed5-92cf-4482-8f51-a01cd9b3ea37}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ede8bed5-92cf-4482-8f51-a01cd9b3ea37}"="antiforeigner"

O2 - BHO: (no name) - {1FC80E00-41B0-4F74-BC16-2C83ED49CAC9} - C:\Program Files\Video AX Object\bpvol.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1FC80E00-41B0-4F74-BC16-2C83ED49CAC9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FC80E00-41B0-4F74-BC16-2C83ED49CAC9}]

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiped 6.1.lnk
%STARTMENU%\MalwareWiped 6.1.lnk
%STARTMENU%\Programs\MalwareWiped 6.1\
%DESKTOP%\MalwareWiped 6.1.lnk
%PROGRAMFILES%\MW\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{035C1836-0D78-DABC-F4A7-D5D0517EE1F9}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A3C742D-8A14-4DD6-806C-CAEC606F6F83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16398BFE-0D35-45A1-AD20-3E5B605D79C5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{347D361F-EC65-450D-9121-AF8E20A3F1C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E2F7E84-20BA-45FA-A72E-9C09B3891E30}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3F84EE83-FD4B-4223-B76E-F23F645DCCB3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50CE778D-7505-4374-ABDB-99C6A5139374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58ADBAFD-D14D-49A2-94EC-4FE8165FD336}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6BEAC051-C197-4951-AF23-4B0522F0303D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{768C89B1-97D9-4153-ACB4-A03FBBFDE184}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{98198A41-C7DB-4F67-AF6C-80F90FEFE047}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A13D839A-E2F0-4E33-B615-592F5CCA5B26}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0E59B82-9A6A-4DFC-94EE-1753A82269A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C70A5BCF-0F65-4F9E-B869-119D60184E1F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DB9996C3-E22F-4096-8349-C3821C08B1E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5C6D1A4-502C-4EC2-A472-D14BE3311335}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE0BB4EE-ECC6-4696-BED1-A802ACFECA80}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A538B417-2054-4F1D-9843-0BC8F94B9889}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiped 6.1.exe 6.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiped 6.1] (C:\Program Files\MW\MalwareWiped 6.1\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWiped 6.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareWiped 6.1"=-



Version 2.176 (May 05, 2007)


%SYSTEM%\xuoce.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{da3b49f6-8c54-4429-a275-21a86dcca413}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{da3b49f6-8c54-4429-a275-21a86dcca413}"="admissibility"



Version 2.175 (May 05, 2007)


%WINDIR%\iedns.dll
%WINDIR%\loader.exe (Already removed)
%WINDIR%\main_uninstaller.exe (Already removed)
%WINDIR%\msdn32.dll
%WINDIR%\msdns.dll
%WINDIR%\tlhelper.dll
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27A7FB75-FB40-4f94-BCF6-4945BCC8BAAF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msdn32.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msdn32.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDNS.MSDNSApp] (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27A7FB75-FB40-4f94-BCF6-4945BCC8BAAF}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}"=- (Already removed)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msdns"=-
"iedns"=-



Version 2.174 (May 02, 2007)


%WINDIR%\browsers.dll
%WINDIR%\ieproxy.dll
%WINDIR%\loader.exe (Already removed)
%WINDIR%\main_uninstaller.exe (Already removed)
%WINDIR%\msie.dll
%WINDIR%\service.dll
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5574E139-F59C-4bee-9A61-150B0D3A16C7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\browsers.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\browsers.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDNS.MSDNSApp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5574E139-F59C-4bee-9A61-150B0D3A16C7}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}"=- (Already removed)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msie"=-
"ieproxy"=-



Version 2.173 (May 02, 2007)


Update: Generic Renos Fix 1.13

%SYSTEM%\lcsrsrv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}"="huet"



Version 2.172 (May 01, 2007)


%SYSTEM%\ilmpjy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4233ac08-a2c4-4742-a0b4-83719613d62c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4233ac08-a2c4-4742-a0b4-83719613d62c}"="grassily"

%SYSTEM%\rcohty.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b23dc537-3e13-44c7-bf67-d8405eb377f7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b23dc537-3e13-44c7-bf67-d8405eb377f7}"="bedstead"

%SYSTEM%\dxovx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{716002db-288c-4bf0-80cd-a467e78d8b55}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{716002db-288c-4bf0-80cd-a467e78d8b55}"="depreciable"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.6.lnk
%STARTMENU%\SpyLocked 3.6.lnk
%STARTMENU%\Programs\SpyLocked 3.6\
%DESKTOP%\SpyLocked 3.6.lnk
%PROGRAMFILES%\SpyLocked 3.6\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{062BC936-7CE4-421C-944E-BD388EC91C86}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22F1A770-B823-48D4-8693-B953902A06EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3A7A14FD-7FEC-48CF-A06F-210344DE6E75}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41E4ADCD-CCC2-4DA0-97C3-83051A4C35F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54D2D4FC-914C-432C-B638-599F48D77A08}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F342C0C-EF49-49E2-B3F1-FE28F193B974}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F61B413-1DFE-4C4C-8CD4-B97BE0B17504}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{764CE36A-C778-42A8-B3B2-4B09A4B10469}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87EA76C9-411E-44D0-8270-EA2DF3941133}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94792C8E-6FE0-462C-9D20-AD560608DDA1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{99EAEF8C-652D-407C-8319-781A2BB30FF7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A392D107-AFBF-4E1B-8092-DB508BC890A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD2AA1CD-22FF-4562-A616-1C64A42985BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2D197C9-8570-4AC8-A121-92F9A8CCD857}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CBCCB1D8-AB10-4B4C-9982-A8DEA99F3111}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F198A883-6BCF-4B94-A890-D8ED007FBCF7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DA226F0-FE43-4F80-A94A-1848039DE0DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.6.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.6] (C:\Program Files\SpyLocked 3.6\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.6]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 3.6"=-



Version 2.171 (April 18, 2007)


%SYSTEM%\yuspej.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3baa1ad8-ee49-4772-bf0b-f55083e0f7aa}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3baa1ad8-ee49-4772-bf0b-f55083e0f7aa}"="ephemeran"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.5.lnk
%STARTMENU%\SpywareLocked 3.5.lnk
%STARTMENU%\Programs\SpywareLocked 3.5\
%DESKTOP%\SpywareLocked 3.5.lnk
%PROGRAMFILES%\SpywareLocked 3.5\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02743820-2E7C-42C6-B60C-726D67379EDB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D8286F5-9606-46C5-89D8-9B6379877732}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{521C4C7E-D2CF-4EB1-A078-6E126269E0AD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67E054FA-0F1E-4AF8-899B-0B52660D7043}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{697C34C8-BBAC-418C-999A-A5525F4FF8C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{711C2540-AA7D-4C40-A8C0-9B1BC920378D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80A2BFBD-7906-48EF-9F76-49B9F822393B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87A8C087-37C2-40C4-9CDF-97437A9F54BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8ED3825E-77A7-41D4-BDCB-FD8CC2B0D183}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2E56D03-930A-4BBF-8C8E-4D63D15F88EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ABAE0DAF-A6BA-481F-B3BA-0666D0D1B2EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5B6AA2C-F0C7-44B9-A861-261958ECD0B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BD8C66A5-617B-4ABF-B56D-F547597FE0FA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D675FD26-7200-466F-A380-182FE49AF8AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8073D3D-D957-45BE-82CA-BB44FD0E9C4B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF906CF9-6EEB-4626-9A17-2E48C11D2995}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A74E275-351B-4072-8F0B-CBE2B7231B37}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLocked 3.5.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.5] (C:\Program Files\SpywareLocked 3.5\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.5]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareLocked 3.5"=-


%PROGRAMFILES%\Video AX Object\

O2 - BHO: (no name) - {D34F5D71-99E4-4D96-91CA-F4104F69B8AE} - C:\Program Files\Video AX Object\bpvol.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D34F5D71-99E4-4D96-91CA-F4104F69B8AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D34F5D71-99E4-4D96-91CA-F4104F69B8AE}]

O3 - Toolbar: Protection Bar - {F0993251-2512-4710-AF6E-0A13EA199D02} - C:\Program Files\Video AX Object\splug.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0993251-2512-4710-AF6E-0A13EA199D02}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0993251-2512-4710-AF6E-0A13EA199D02}"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video AX Object]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert]
[-HKEY_CURRENT_USER\Software\Protection Tools]



Version 2.170 (April 18, 2007)


NTFS Bug Correction

%SYSTEM%\czxtyx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e4e5110-a772-4c4a-a7dc-137fe10abd6e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0e4e5110-a772-4c4a-a7dc-137fe10abd6e}"="calocarpum"



Version 2.169 (April 16, 2007)


%WINDOWS%\dxdiag.dll
%WINDOWS%\iebrowser.dll
%WINDOWS%\iecontext.dll
%WINDOWS%\loader.exe
%WINDOWS%\main_uninstaller.exe (Already removed)

%DESKTOP%\Privacy Protector.url
%DESKTOP%\Spyware&Malware Protection.url
%DESKTOP%\Error Cleaner.url

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06CB2908-DD90-4293-8C98-9ABA1025F163}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3828496C-9E4F-4278-8C85-0DF3A3CB41EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{477D1353-BA0E-43CC-8F40-DEA6BF81ADEE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BD7DB09-1199-41E2-BE9D-AB1D29DD0C3E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C42E5047-FCAD-4B62-A4B0-1052C76A9E1B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F301710A-1204-44C8-A611-E89E58FEFFDA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"iebrowser"=-
"iecontext"=-



Version 2.168 (April 14, 2007)


Update: Generic Renos Fix 1.12

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.4.lnk
%STARTMENU%\SpywareLocked 3.4.lnk
%STARTMENU%\Programs\SpywareLocked 3.4\
%DESKTOP%\SpywareLocked 3.4.lnk
%PROGRAMFILES%\SpywareLocked 3.4\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{212DF34E-EAD7-4831-89D8-70CB70581D82}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69F0456D-B449-4FAC-AF03-B0FBB4B39C53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7A3BABC0-3D33-4B9D-B11E-EF36E1BFFFBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F71D7E5-202B-4B8D-94EB-2B30E4212C18}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8FF07C20-5965-476E-84E8-82374C559BE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ADA0950-D83C-4C52-83AE-D8258A4B527E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A829592E-08BA-4D4D-87C8-6524687D90E6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AC66E7A3-928B-4F20-B7AC-B3A86298005C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B14649A3-BD2E-4483-B8D6-BF80F82F5D24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B87C48D1-28E3-48FC-9B27-EEDBB7619A17}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA091197-32FE-48D8-8696-AF64D8A1CA44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF4DDC95-8A4B-47C1-A89E-0CBF849DE042}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D74998BF-0AB6-4C8D-801D-EB50CB73FFDF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E849D321-F077-4946-94EF-696F864F0BE5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EA5973F9-1064-4393-838F-1B44CB09A1DE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F0091942-BEF6-447E-8F73-B844A4F62851}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{04B12611-E1E1-45E3-9376-91984B957880}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLock.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.4] (C:\Program Files\SpywareLocked 3.4\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.4]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareLocked 3.4"=-



Version 2.167 (April 13, 2007)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brave-Sentry]
[-HKEY_CURRENT_USER\Software\Brave-Sentry]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Brave-Sentry"=-

%SYSTEM%\ygjun.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{abef791f-947e-4cdf-83c3-e72a240afb67}"="frisbee"



Version 2.166 (April 07, 2007)


%PROGRAMFILES%\MovieBox\
%STARTMENU%\Programs\MovieBox\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MovieBox]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MovieBox] (C:\Program Files\MovieBox\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\MovieBox]



Version 2.165 (April 06, 2007)


%SYSTEM%\pkgvyg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0ded443-5e68-4001-a81b-0a0001621ab8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b0ded443-5e68-4001-a81b-0a0001621ab8}"="excreted"



Version 2.164 (April 05, 2007)


%SYSTEM%\qzviz.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd0fc212-0a36-4232-83cc-2063fb9282e0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bd0fc212-0a36-4232-83cc-2063fb9282e0}"="curdler"

Spy-Locked.exe
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.3.lnk
%STARTMENU%\SpywareLocked 3.3.lnk
%STARTMENU%\Programs\SpywareLocked 3.3\
%DESKTOP%\SpywareLocked 3.3.lnk
%PROGRAMFILES%\SpywareLocked 3.3\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0118155F-254E-4899-B4B0-C12A7D27BD43}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0F4C207D-8105-4A69-9597-CA35DD7D40E0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1767B8C0-D7CA-4714-B50E-E10883B49423}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{222B2001-A14D-40AB-A97A-866C31E64B6C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38CD31E1-73C2-48C0-B0DF-80BD6BA93F40}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5799265E-3E51-4B72-8420-75A71EE94E26}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{866B2BD1-5F33-4472-80E5-3216A92373E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9894863A-C28A-4D01-B3C5-E6222A789AFE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B2266AD8-EAA6-4934-98E3-34CF67E08374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC25B50A-E1AE-4345-BB9B-0778DF760BE1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C108A1D9-28AD-40E5-B257-ED9062A14244}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CED85FB9-B4C0-4CFC-A7BE-2C73BAE15D51}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7473324-9D79-45B6-AD7F-333EF7D1A64B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D753CDA9-396B-415B-8379-AAF5902814DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F33B0E47-DB00-4DF3-B930-A3C558D58B33}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FBC8307B-4BD0-46F1-8350-122585D75DB2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE68E48B-1A55-49D7-BF9F-A8DFDA47A91F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Spy-Locked.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.3] (C:\Program Files\SpywareLocked 3.3\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.3]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareLocked 3.3"=-



Version 2.163 (April 04, 2007)


%WINDOWS%\iesettings.dll
%WINDOWS%\iesupport.dll
%WINDOWS%\iedebug.dll
%WINDOWS%\main_uninstaller.exe

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5F90B57B-3F17-4D9B-8909-1A32AFD6EC0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF0D1E98-4FAF-44BD-8ECA-E745820E63DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"iesupport"=-
"iedebug"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{234FF2FC-BB16-4A7C-AC09-A833CB3D56FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27CF2E73-9839-404B-85A8-8FB7EE27474C}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F86727C-57A3-410E-AB91-176730DAEB45}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B5D099E3-B033-4DB3-A7A6-465859B7A477}]



Version 2.162 (March 30, 2007)


Added: DNS IP to detect: (69.50.x.x, 195.95.x.x)



Version 2.161 (March 30, 2007)


%SYSTEM%\yronl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1cb82d6d-f9a3-40c4-8ad5-6d7ea00ed6ad}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1cb82d6d-f9a3-40c4-8ad5-6d7ea00ed6ad}"="haefner"



Version 2.160 (March 29, 2007)


Added: Check for DNS Hijack and configure to DHCP (85.255.x.x)



Version 2.159 (March 29, 2007)


Added: HostsChk.exe (filter for WhiteList hosts)

%SYSTEM%\oyopu.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df8c3aed-b58e-4bcb-96b3-aa1b7bbdbbd4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{df8c3aed-b58e-4bcb-96b3-aa1b7bbdbbd4}"="homina"



Version 2.158 (March 26, 2007)


Update: Generic Renos Fix 1.11

%SYSTEM%\qvjpt.dll
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{07a582e8-bae3-457d-9d29-2048de45a369}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{07a582e8-bae3-457d-9d29-2048de45a369}"="grithbreach"



Version 2.157 (March 26, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.2.lnk
%STARTMENU%\SpywareLocked 3.2.lnk
%STARTMENU%\Programs\SpywareLocked\
%DESKTOP%\SpywareLocked.lnk
%PROGRAMFILES%\SpywareLocked\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15A6894B-53B5-46C0-8C38-050E21DDD201}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17468406-36B6-4BD1-9B6C-3CC320CF28F6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F3FF99D-E078-4968-B9C1-87A74C7736CB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34A0B812-915E-46F2-9F29-DF0F0CF97611}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46018FD4-1675-4020-85DC-A3A0EEB7BDA0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54F04ACA-CC8C-4C70-A8BC-D5C53D381EE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{655C070F-6724-45BC-BD5E-23609B6D4A3F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78C9E0DA-3BB5-4156-A03C-8326322F10DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F21289A-BB27-49E9-92C3-2BF7910B6072}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{88C13519-616E-4A0D-B9EF-441D04891B6F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94E13FCA-4BAC-4C2A-A5DF-746460090F9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CEBEA6DB-DAE7-4146-BABA-1FBCD1D50426}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D152938D-32E1-43A6-81C7-898502AABF9A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD348AC9-1D04-439A-B451-9A83BD66423B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB2FC31-CCC1-4D85-869F-D288E2386DBD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9A34E6B-4C2A-4F58-B302-79CACCD62C5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A0181CF2-4A15-4CB5-88D7-15EAA2D08A46}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLocked.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked] (C:\Program Files\SpywareLocked\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareLocked"=-



Version 2.156 (March 26, 2007)


Added: Process List
Added to Process Killed: isamntr.exe, pmmnt.exe, pmsnrr.exe

%SYSTEM%\AntiSpy.exe
%SYSTEM%\Spykiller.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"value"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"value"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"value"=-

%SYSTEM%\tahxqcj.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d6fac42-a7be-4702-87ef-75d8dc14249e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9d6fac42-a7be-4702-87ef-75d8dc14249e}"="hemine"



Version 2.155 (March 24, 2007)


%SYSTEM%\bhoSearchSpy.dll

O2 - BHO: IE SecPlugin - {F5BDC469-1EC5-4193-824B-2E209993D183} - C:\WINDOWS\system32\bhoSearchSpy.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5BDC469-1EC5-4193-824B-2E209993D183}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bhoSearchSpy.IESecPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5BDC469-1EC5-4193-824B-2E209993D183}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE SecPlugin_is1]


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwaresWipeds 5.3.lnk
%STARTMENU%\MalwaresWipeds 5.3.lnk
%STARTMENU%\Programs\MalwaresWipeds\
%DESKTOP%\MalwaresWipeds.lnk
%PROGRAMFILES%\MalwaresWipeds\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DDBC9CF-30B8-8733-7445-754FC2F405F2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07F8DED2-2140-400E-86F3-6C6E5AD2B002}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23BFD4B1-C4EA-453A-89BD-EC9D536891B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D5B03F2-3D12-4BC2-8A89-8D40AFE15190}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E699B22-FC07-4A9B-B98C-E9B965BFFE7C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{32C42863-E65F-453C-A8FF-60A8F035F57D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{350C54AD-E069-454C-A613-CA8154149E7A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{404A6E3F-1747-4D1B-8285-2C4B8A4B21D4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{776E27AE-419C-4529-9B18-4E71A5EA64A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BC72975-C801-4534-B103-476EF5D0D17D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BF1461E-228F-4509-8C58-4EB1FBFC19F3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ECD20CF-AF6D-40E1-A1B8-7B6BEABB793E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC158F0C-319D-42A9-8532-134D746D136D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF1A0A91-ABFB-4717-B7B9-D88647EA2529}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C492F812-B194-4C72-81EF-B17D9D973777}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D57FD11F-52DA-42F6-B12E-2447593B402B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1B13777-B021-41E1-BFE6-896E5C1CF163}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A366DE26-3628-46F9-9ABA-0BD450247999}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwaresWipeds.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwaresWipeds] (C:\Program Files\MalwaresWipeds\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwaresWipeds]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwaresWipeds"=-


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyHeals 2.3.lnk
%STARTMENU%\SpyHeals 2.3.lnk
%STARTMENU%\Programs\SpyHeals\
%DESKTOP%\SpyHeals.lnk
%PROGRAMFILES%\SpyHeals\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A479D87-72AC-4DCE-A3F1-FDC882390F60}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{161D399B-0789-4402-864E-F4347690BD48}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16737204-F9B6-45D0-BA08-EC632ACA96EA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22C0F9FE-1453-4925-A7C9-7D118611770E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37EEB3B8-A21E-4799-9266-9EC7D945674B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3BEE5AE6-A4D8-4FD3-B5D5-1385CEA2A22C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46593BFA-1D7A-4A56-90EE-88E852649F3D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A7CC1B7-3BA5-4CF6-8098-56D315EBEE11}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55DADDE6-2501-415A-BC5F-6F75D6E771C5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6C6E6CB6-8156-4901-AA42-B535181D17A3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{775AD947-7128-4774-8623-55FADB5F74BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77DF43A0-4CD3-4BE1-B4FC-8B9F3857CBB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80787CB9-2E40-42BA-927A-C7E09C2C3D2E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8458EDF5-1DFD-4BF0-95AC-1D7463031D92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5BB6E2B-6CB5-4AAD-AEF7-2484D3E04EEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7137690-A900-4F77-824E-EC0177D74FD0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyHeals.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyHeals] (C:\Program Files\SpyHeals\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyHeals]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyHeals"=-



Version 2.154 (March 23, 2007)


%PROGRAMFILES%\Win32z1Messenger\
%PROGRAMFILES%\MSmessangerapi\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B9B7B2E-30E3-4C5D-AD2C-C38724979B4B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B9B7B2E-30E3-4C5D-AD2C-C38724979B4B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3ED808D8-9119-4757-B7BE-40C463452F87}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{580EB069-9905-4A04-A20C-AD6598D8C0A3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{55149956-1A81-44F8-A00A-F9CF7CA03329}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Sb6.StrangeBho]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Sb6.StrangeBho.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bal"=-



Version 2.153 (March 23, 2007)


%PROGRAMFILES%\Win32p1Messenger\

O2 - BHO: SysMon Class - {D5EFDB0E-4F51-414F-B740-54A5C87A8957} - C:\DOCUME~1\user\LOCALS~1\Temp\accute.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D5EFDB0E-4F51-414F-B740-54A5C87A8957}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D5EFDB0E-4F51-414F-B740-54A5C87A8957}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DFD2740F-66FE-4C66-ABE7-53A599B78D1D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31EA8BF4-9F47-4A04-A33A-66D6B22A40CC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SysMonitor.SysMon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SysMonitor.SysMon.1]

O4 - HKLM\..\Run: [mstss] C:\Program Files\Win32p1Messenger\mstss.exe (Already removed)

%HOMEDRIVE%\config.sy_

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"none"=-
"isamini.exe"=-



Version 2.152 (March 21, 2007)


%STARTMENU%\Programs\MovieCommander\
%PROGRAMFILES%\MovieCommander\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MovieCommander]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MovieCommander] (C:\Program Files\MovieCommander\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\MovieCommander]

%STARTMENU%\Programs\SiteEntry\
%PROGRAMFILES%\SiteEntry\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SiteEntry]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SiteEntry] (C:\Program Files\SiteEntry\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\SiteEntry]

%SYSTEM%\mshlpp.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-wordapp]

%STARTMENU%\Programs\PrivateVideo\
%PROGRAMFILES%\PrivateVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PrivateVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PrivateVideo] (C:\Program Files\PrivateVideo\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\PrivateVideo]



Version 2.151 (March 20, 2007)


%WINDOWS%\iexplorer.exe
%WINDOWS%\ielocales.dll
%WINDOWS%\policies.dll
%WINDOWS%\policyverifier.exe
%SYSTEM%\policies\
%SYSTEM%\policies\ppdriver.sys (ppdriver service)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"PolicyVerifier"=-

O2 - BHO: SmartPics Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\WINDOWS\Policies.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}]

O2 - BHO: TMSN Class - {B72549CE-5644-4116-B8A4-A2B042321EC4} - C:\WINDOWS\Policies.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B72549CE-5644-4116-B8A4-A2B042321EC4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B72549CE-5644-4116-B8A4-A2B042321EC4}]

O2 - BHO: TKTS System - {A717DBE3-D78D-4aa7-BDCF-2CC06B36371B} - C:\WINDOWS\Policies.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A717DBE3-D78D-4aa7-BDCF-2CC06B36371B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A717DBE3-D78D-4aa7-BDCF-2CC06B36371B}]

O2 - BHO: VPNS System - {366B2151-E1C7-44a3-86A3-E5686C2A3D2F} - C:\WINDOWS\iedrives.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}]

O2 - BHO: MSNM System - {A646CE7E-951E-44d1-B93C-F7136DA41E58} - C:\WINDOWS\ielocales.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A646CE7E-951E-44d1-B93C-F7136DA41E58}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A646CE7E-951E-44d1-B93C-F7136DA41E58}]

%SYSTEM%\onwtj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}"="chitosan"

%SYSTEM%\fyxkaah.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b292ec9f-a074-4115-8342-1f459702d8d2}"="characterizing"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.1.lnk
%STARTMENU%\SpyLocked 3.1.lnk
%STARTMENU%\Programs\SpyLocked\
%DESKTOP%\SpyLocked.lnk
%PROGRAMFILES%\SpyLocked\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C5B5226-045D-4A46-B4FC-228B0891FEEC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{314120E4-5A05-492C-9BF2-22558CF0F202}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{392D4A36-6ADF-4A99-A820-3014A53E62E3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3BF6C840-4D12-4FB5-88A2-E2BC03461DC2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{42F16135-D0A4-43A2-990C-27FCABD9C19F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43DF1CEE-70B3-4E2D-A740-4AC468786207}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D31CCA1-C42B-4796-851F-CA8ED4CD2A7E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5CA1A9F6-10F8-4008-B884-755B25B6848A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{630CBF61-54CC-4AC3-97B0-D4071345807C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AFB5B8E-ACFD-4489-91B3-DAA1388A31EC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{815B01A0-BF97-41E9-ACF2-32B76F98A960}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5BF4465-5322-462F-B41F-459F649F3996}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E4703CF2-7F82-4AD7-B317-8EC1CBC9B619}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9817993-83FF-4343-B14E-6CDFB378B21D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EDE2A2B4-B1CB-4BF8-93D1-154E49284A71}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5D23930-23C6-440E-AB55-D019E1171539}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{50450F27-B90B-422B-A4C9-5EC5A5B78001}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked] (C:\Program Files\SpyLocked\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked"=-

%SYSTEM%\wincrt.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Critical Alert"=-



Version 2.150 (March 19, 2007)


%SYSTEM%\msdrives\
%SYSTEM%\msdrives\driverpp.sys (driverpp service)
%WINDOWS%\iedrives.dll
%WINDOWS%\msdrv.exe
%WINDOWS%\msdrvctrl.exe

%PROGRAMFILES%\NewMediaCodec
%SYSTEM%\drives\
%SYSTEM%\drives\pnpdrv.sys (pnpdrv service)
%WINDOWS%\iedrv.exe
%WINDOWS%\iedrvctrl.exe
%WINDOWS%\iexploree.dll
%WINDOWS%\mslog.exe
%DESKTOP%\PrivacyProtector.url
%DESKTOP%\SystemDoctor.url
%DESKTOP%\WinAntiSpyware 2007.url

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5845A98-EBDA-4670-9DE6-5201C506E741}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5845A98-EBDA-4670-9DE6-5201C506E741}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"iedrvctrl"=-
"ielogger"=-
"IExplorer"=-
"msdrvctrl"=-



Version 2.149 (March 07, 2007)


%windir%\Tasks\At?.job
%windir%\Tasks\At??.job



Version 2.148 (March 07, 2007)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoAXObject.Chl]

O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6ACAE64-F798-4930-AD86-BD3FB32038DB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6ACAE64-F798-4930-AD86-BD3FB32038DB}]



Version 2.147 (March 02, 2007)


%SYSTEM%\tvomnc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{634be415-da12-496b-b89e-329b73c4807f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{634be415-da12-496b-b89e-329b73c4807f}"="cam"



Version 2.146 (March 01, 2007)


%SYSTEM%\geplxss.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aed6f6a3-183c-488d-9f90-23db99f56e7f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{aed6f6a3-183c-488d-9f90-23db99f56e7f}"="apathies"



Version 2.145 (February 28, 2007)


%SYSTEM%\tcpipmon.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tcpipmon"=-



Version 2.144 (February 21, 2007)


%PROGRAMFILES%\Internet Security

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"user32.dll"=-
"rare"=-



Version 2.143 (February 20, 2007)


%PROGRAMFILES%\Video Access ActiveX Object
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\videoaccessactivex.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Access ActiveX Object] (C:\Program Files\Video Access ActiveX Object\uninst.exe)

%SYSTEM%\higehsg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2016a466-91a2-43c6-97d8-2fd380f065ef}"="eitheror"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"eitheror"="{2016a466-91a2-43c6-97d8-2fd380f065ef}"

%SYSTEM%\xkrdk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8329660f-e248-4872-98cc-fb9c4fec7ba8}"="didynamia"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"didynamia"="{8329660f-e248-4872-98cc-fb9c4fec7ba8}"



Version 2.142 (February 13, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyDawn 3.1.lnk
%STARTMENU%\SpyDawn 3.1.lnk
%STARTMENU%\Programs\SpyDawn\
%DESKTOP%\SpyDawn.lnk
%PROGRAMFILES%\SpyDawn\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1DF2728-8510-0773-96D8-5D0C1F27821B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{189518DF-7EBA-4D31-A7E1-73B5BB60E8D5}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76D06077-D5D3-40CA-B32D-6A67A7FF3F06}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9283DAC1-43F5-4580-BF86-841F22AF2335}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE90CAFC-09D4-47F0-9E11-CE621C424F08}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA397E39-F67F-423F-BC6E-65939450093A}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4EEDC19-992D-409A-B323-ED57D511AFA5}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD90F677-D205-4F70-9014-659614AABCB2}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DF91F3-F24F-441E-9001-D61F36024322}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F459EADB-5903-48D5-864C-2B7B46AB1424}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4EDF66-0547-4F1A-AE96-7CFCAD711C90}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyDawn.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyDawn] (C:\Program Files\SpyDawn\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyDawn]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyDawn"=-



Version 2.141 (February 7, 2007)


Added: Vista OS detection

%SYSTEM%\svshost.dll (Backdoor.Win32.Small.ls)
%SYSTEM%\wininet.exe (Backdoor.Win32.Small.ls)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SysRun"=-

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyCrush 5.1.lnk
%STARTMENU%\SpyCrush 5.1.lnk
%STARTMENU%\Programs\SpyCrush\
%DESKTOP%\SpyCrush.lnk
%PROGRAMFILES%\SpyCrush\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{189518DF-7EBA-4D31-A7E1-73B5BB60E8D5}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76D06077-D5D3-40CA-B32D-6A67A7FF3F06}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9283DAC1-43F5-4580-BF86-841F22AF2335}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE90CAFC-09D4-47F0-9E11-CE621C424F08}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA397E39-F67F-423F-BC6E-65939450093A}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4EEDC19-992D-409A-B323-ED57D511AFA5}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD90F677-D205-4F70-9014-659614AABCB2}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DF91F3-F24F-441E-9001-D61F36024322}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F459EADB-5903-48D5-864C-2B7B46AB1424}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4EDF66-0547-4F1A-AE96-7CFCAD711C90}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyCrush.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyCrush] (C:\Program Files\SpyCrush\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyCrush]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyCrush"=-





Version 2.140 (February 6, 2007)


Update: remove from hosts file computing.net, spywareinfo.com,
lavasoftsupport.com, majorgeeks.com, microsoft.com, pandasoftware.com,
wilderssecurity.com

Add: Update mirror

%WINDOWS%\dr.exe
%WINDOWS%\user32.exe
%WINDOWS%\Tasks\At1.job
%WINDOWS%\Tasks\At2.job
%PROGRAMFILES%\dr.exe
%PROGRAMFILES%\dr.exe~
%PROGRAMFILES%\patcher.exe
%PROGRAMFILES%\serial.dat
%PROGRAMFILES%\serial.zip
%PROGRAMFILES%\user32.exe
%PROGRAMFILES%\widupdate.exe
%PROGRAMFILES%\widupdate.exe~




Version 2.139 (February 5, 2007)

Update: remove following servers from hosts file:

arovax.com, bleepingcomputer.com, boskak.za.net, bullguard.com, castlecops.com,
compu-docs.com, dell.com, depannetonpc.net, digitaltrends.com, ewido.net,
geekstogo.com, greyknight17.com, idg.pl, infos-du-net.com, innovative-sol.com,
lockergnome.com, mytechsupport.ca, prevx.com, siri.urz.free.fr, spybot.info,
stevengould.org, sunbelt-software.com, spywareinfo.dk, superantispyware.com, techguy.org,
techsupportforum.com, tomcoyote.org

%SYSTEM%\cwgppb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2acf3add-34a1-4f2f-99cf-cc69785d1e90}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2acf3add-34a1-4f2f-99cf-cc69785d1e90}"="exemplars"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"exemplars"="{2acf3add-34a1-4f2f-99cf-cc69785d1e90}"



Version 2.138 (February 2, 2007)


Update: Generic Renos Fix

%SYSTEM%\vblhanf.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}"="didymiums"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"didymiums"="{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVermeans 2.1.lnk
%STARTMENU%\AntiVermeans 2.1.lnk
%STARTMENU%\Programs\AntiVermeans\
%DESKTOP%\AntiVermeans.lnk
%PROGRAMFILES%\AntiVermeans\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82C9202F-07E7-C95D-0A61-7FCBB3DC4E2A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E109276-830E-4543-980D-660F305D052C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21E5890D-B0C0-43FC-9FFA-971E53757CEC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A7C0BB3-BAB7-4203-BF09-AE0F7187A76B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{349FB887-0A21-47FF-95AD-F311B68E1B0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{73F1B1C8-D0FF-466A-91C0-2995ECE1D7E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{796854B1-D0B2-471A-9047-9FAABA829DDD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7B519915-0E5C-429B-AF50-2B1FD12A80C7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82B8F5FA-8541-4E3E-BB71-9237B638E51C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91251C12-212A-4847-AB34-6C0DE694F83D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92F553B0-3499-4E89-A25D-AB0865DD8A69}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0305F7E-4BEF-49AB-9FC1-3CD0964FEE9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A426E333-4E91-4995-9662-E709BBDAA549}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6CA4EAC-3168-4F1B-B8CF-84765E1781C8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C24E6ABD-2409-478E-91C2-9AFF9817C10A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E20C255D-E938-49DB-89BA-1A1B27ABDCF3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3A2FFC7-5B66-4150-AA51-5D4CED1E73EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9A4EC679-4D9A-4165-8562-9584E13A9CEA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVermeans.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVermeans] (C:\Program Files\AntiVermeans\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVermeans]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVermeans"=-



Version 2.137 (January 27, 2007)


Bug correction in huy32 service detection

%STARTMENU%\Programs\SpyMarshal\
%DESKTOP%\SpyMarshal.lnk
%PROGRAMFILES%\SpyMarshal\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyMarshal] (C:\Program Files\SpyMarshal\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\Install] (Already removed)
[-HKEY_CURRENT_USER\Software\SpyMarshal]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpyMarshal"=-



Version 2.136 (January 26, 2007)


Added: huy32 driver detection.

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWipePro 4.3.lnk
%STARTMENU%\MalwareWipePro 4.3.lnk
%STARTMENU%\Programs\MalwareWipePro\
%DESKTOP%\MalwareWipePro.lnk
%PROGRAMFILES%\MalwareWipePro\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9DFD0A51-6176-5770-217C-A5BCD7E6F3E2}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{01AEC716-82E6-4D7D-AAE9-E7A3C77669FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{158CB0F8-4E71-483B-8A1F-E5F6A2925186}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43B4B286-7D63-49BF-925C-76DB02FB913C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E308A8E-090D-41D4-9566-0CF5DBCE77BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B457C20-B311-47D6-8462-2A58D14444F3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6570C315-8FE3-4C92-8772-B2EE963CE446}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D4714BE-DA43-41F5-BCF3-5AEF3C95EC42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86861886-7780-4650-BFED-60E07AE63ED3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94C6F9C7-CDE7-4E81-A5B0-8245E3001B23}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E0A6A56-E495-41B1-A72C-DDBFF7B1147D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A62C8043-EDE3-45B8-8477-FD77CB8746C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD9BDAB2-76A9-400C-8F4D-F12733D33526}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C8296F61-C691-498E-A509-C1C0C1A879A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CCBF4AEA-E9E3-4D8A-9F51-7D20C4415C2C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D65BDB94-8AE3-4509-B0CA-2AC8A3B758EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC780A3C-EE81-47B9-97F0-4886EE215105}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E6CD430B-4CDF-4D5E-9071-16085471B882}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWipePro.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWipePro] (C:\Program Files\MalwareWipePro\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWipePro]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareWipePro"=-

%STARTMENU%\Programs\VideoBox\
%PROGRAMFILES%\VideoBox\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoBox]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoBox] (C:\Program Files\VideoBox\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\VideoBox]

%PROGRAMFILES%\WinAntiSpyPro\
mstss.exe
plugin.exe
updchk.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mstss"="C:\Program Files\WinAntiSpyPro\mstss.exe"
[-HKEY_CURRENT_USER\Software\WinRAR SFX]

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpySoldier.lnk
%USERPROFILE%\Local Settings\Application Data\SpySoldier\
%ALLUSERSTARTMENU%\Programs\SpySoldier\
%DESKTOP%\SpySoldier.lnk
%PROGRAMFILES%\SpySoldier\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpySoldier_is1] (C:\Program Files\SpySoldier\unins000.exe)
[-HKEY_CURRENT_USER\Software\SpySoldier]

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareKnight.lnk
%USERPROFILE%\Local Settings\Application Data\SpywareKnight\
%ALLUSERSTARTMENU%\Programs\SpywareKnight\
%DESKTOP%\SpywareKnight.lnk
%PROGRAMFILES%\SpywareKnight\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareKnight_is1] (C:\Program Files\SpywareKnight\unins000.exe)
[-HKEY_CURRENT_USER\Software\SpywareKnight]

%STARTMENU%\Programs\PestCapture\
%DESKTOP%\PestCapture.lnk
%PROGRAMFILES%\PestCapture\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PestCapture] (C:\Program Files\PestCapture\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\Install]
[-HKEY_CURRENT_USER\Software\PestCapture]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PestCapture"=-

O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Video ActiveX Object\iesplugin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84938242-5C5B-4A55-B6B9-A1507543B418}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{84938242-5C5B-4A55-B6B9-A1507543B418}"=-



Version 2.135 (January 24, 2007)


Update: Detection of new version of the CTDrive key and drv???.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctpmon"=-



Version 2.134 (January 24, 2007)


%SYSTEM%\ctpmon.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Svshostt.arty]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctpmon"=-

%SYSTEM%\RegistryCleanerSetup.exe
%DESKTOP%\Registry Cleaner.lnk
%STARTMENU%\Programs\Registry Cleaner\
%PROGRAMFILES%\RegistryCleaner\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RegistryCleaner] (C:\Program Files\RegistryCleaner\uninstall.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\RegistryCleaner]



Version 2.133 (January 21, 2007)


%SYSTEM%\gwquvw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8d8c2387-7f80-4022-9be6-43630a969558}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"carbinyl"="{8d8c2387-7f80-4022-9be6-43630a969558}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8d8c2387-7f80-4022-9be6-43630a969558}"="carbinyl"

%SYSTEM%\axlet.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8670ee50-01f9-47da-ac1e-cf8549e9e521}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"eupeptic"="{8670ee50-01f9-47da-ac1e-cf8549e9e521}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8670ee50-01f9-47da-ac1e-cf8549e9e521}"="eupeptic"

%SYSTEM%\oksrqqu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c4f2cbc-f32d-4a03-9812-86f39379811b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"breadthes"="{5c4f2cbc-f32d-4a03-9812-86f39379811b}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5c4f2cbc-f32d-4a03-9812-86f39379811b}"="breadthes"

%SYSTEM%\nbbrhbd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hirtellous"="{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}"="hirtellous"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVerminser 2.1.lnk
%STARTMENU%\AntiVerminser 2.1.lnk
%STARTMENU%\Programs\AntiVerminser\
%DESKTOP%\AntiVerminser.lnk
%PROGRAMFILES%\AntiVerminser\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01775F16-B10C-B483-63E3-AFCED5DCDEF2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{118601E4-0BC8-4B98-AAEC-723EBA43ED33}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15548C74-5C8B-4911-AE88-739DD473E2BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{468164CC-476E-47D5-9269-278D0DB22A13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{478B7D17-F00A-4AB3-B802-46972CAB1AE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4FCD9AB0-0765-4117-A612-DB3B4FAC1EE3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D89BA32-C9F8-48CC-B22A-18C808DF6D83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{698664FF-F50E-4BDC-B9C0-C00F96A64B84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89AE8B3E-3EE8-4068-8932-60CA9E6AC40B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{93362B42-9631-4BAE-92EF-7726E5DD747D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{999E9507-216C-4A7A-B103-57D3FF617E49}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A5A2382E-6EA1-40C9-9EEB-FCE758A7A3F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C20782A3-B65D-41AB-8D04-BBE3122363C2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C54890B0-B9F8-4E58-9715-8C58B52A4D5D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D037BE5C-7E06-4D4D-8729-FD1EE7E59C89}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D108017B-1769-4BFB-8A4C-0E6202FDBD08}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DECC44F4-E972-4E5C-8F5F-238295C5ADD5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{823B335C-00DE-4886-BE7A-FBDC0F69294E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVerminser.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVerminser] (C:\Program Files\AntiVerminser\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVerminser]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVerminser"=-



Version 2.132 (December 29, 2006)


%SYSTEM%\autosys.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoSys"=-

%FAVORITES%\Online Security Test.url

%STARTMENU%\Programs\SiteTicket\
%PROGRAMFILES%\SiteTicket\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SiteTicket]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SiteTicket] (C:\Program Files\SiteTicket\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\SiteTicket]

%STARTMENU%\Programs\DirectVideo\
%PROGRAMFILES%\DirectVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DirectVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectVideo] (C:\Program Files\DirectVideo\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\DirectVideo]

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiped 5.2.lnk
%STARTMENU%\MalwareWiped 5.2.lnk
%STARTMENU%\Programs\MalwareWiped\
%DESKTOP%\MalwareWiped.lnk
%PROGRAMFILES%\MalwareWiped\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{035C1836-0D78-DABC-F4A7-D5D0517EE1F9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B5398C2-D494-426C-A32B-4C27687ABE1B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{12BFCFD5-4661-430F-A6C9-75CBA2396880}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1B845818-D6E1-4B94-B3BE-65B184165B13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22E02478-B924-4878-B671-6C620BAC5F46}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{314009BF-F3FC-4C90-82E0-2DE859FD1ED8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{363FFCD3-D837-4949-BB15-9FF91D8D3D6F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{434FB119-3862-46DD-A420-D8A1836549E5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{612CA5DF-DDBD-4BA3-BEB6-F879CB521AE0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D5247D5-609B-4C07-A04B-D8EAE34A2E10}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80361051-7283-4C4F-A774-7392FC2B1703}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8EB34398-737F-46DD-BC79-FFF8CDE2782A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1B5425B-9D99-4419-B3E6-24C0944EF382}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B74B7120-D7B8-4BF7-8CC0-8B49196E1642}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0EE9256-C6A0-491D-B28A-48807B5572BF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2220318-770B-45C7-B2CF-66022CE7E073}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF42E571-31B5-4BF6-B80A-19B83F030DB0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B73CD73D-026D-43A5-97D4-D175A5DEC129}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiped.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiped] (C:\Program Files\MalwareWiped\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWiped]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareWiped"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VAXObject.Chl]

%PROGRAMFILES%\Image ActiveX Object\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IAXObject.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image ActiveX Object] (C:\Program Files\Image ActiveX Object\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Key Generator\isaddon.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}]

O3 - Toolbar: Safety Bar - {fbea0445-4c4a-4136-864a-c72a4a182a84} - C:\Program Files\Safety Bar\SafetyBar.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fbea0445-4c4a-4136-864a-c72a4a182a84}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{fbea0445-4c4a-4136-864a-c72a4a182a84}"=-

O3 - Toolbar: Safety Bar - {18668683-731c-48fa-b1b9-ad013748fb00} - C:\Program Files\Safety Bar\SafetyBar.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18668683-731c-48fa-b1b9-ad013748fb00}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{18668683-731c-48fa-b1b9-ad013748fb00}"=-

O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - C:\Program Files\VideoKeyCodec\iesplugin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}"=-

%SYSTEM%\cthkpcv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"buprestidae"="{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"

%SYSTEM%\ownyhr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a4b860b-b18e-4afe-9b26-2a19268eb6be}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"cecropia"="{9a4b860b-b18e-4afe-9b26-2a19268eb6be}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9a4b860b-b18e-4afe-9b26-2a19268eb6be}"="cecropia"

%SYSTEM%\vwfps.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{951a98d0-dad6-4a77-8280-a494279a884b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"beeper"="{951a98d0-dad6-4a77-8280-a494279a884b}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{951a98d0-dad6-4a77-8280-a494279a884b}"="beeper"



Version 2.131 (December 17, 2006)


Update: Generic Renos Fix 1.10

%SYSTEM%\cvnzie.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe288882-f661-4522-88f3-20cfb7866fa4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fe288882-f661-4522-88f3-20cfb7866fa4}"="gutturalness"

%SYSTEM%\hjpprpu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3c767c6b-602d-4b9b-829d-a3dc5b2d89dd}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3c767c6b-602d-4b9b-829d-a3dc5b2d89dd}"="haematobia"

%SYSTEM%\kuhmk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4fbbdfd6-2ca9-4bba-93e4-aadf75321bca}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4fbbdfd6-2ca9-4bba-93e4-aadf75321bca}"="discriminable"

AntiVermins changes:
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A1949AB-8B12-4A6F-9B5D-12D4115CCCEA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1724E437-1FCE-4D21-95E2-6E2452C25628}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1ECABCEE-5F00-449B-BBE3-9C35E160E832}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D652EC7-AF61-487A-B82A-0C4A6A9FF3C8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{500B879D-86C3-4C45-943F-3FC3BF793B38}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50FE5318-DC2A-440A-AC94-B9041819EE48}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59DAA331-B3F9-408E-81DF-ADE79D129600}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B768BE7-942B-4838-89BF-40AB729A62AB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C0B132E-86CB-4B3B-9CAF-CB7F57A60C81}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78E2412E-3C9A-4EE8-AD97-3ABD95EC49D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85524659-53E5-40AF-835B-2F0B8745DF0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9A9D1422-D311-4673-8579-61FCDB76BD0D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B6CDDF17-9F1A-47CA-8E3D-FF6BD1B05D3F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D6BD48FC-DD6F-4242-90B0-6CBE4AD43362}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7D22218-EBF0-454C-B948-11BB8FC3118B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ECA8F1E3-C03F-47E6-842D-7B2BCF0445CA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6B112EBD-0C90-4AC4-A969-F36797F00006}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVermins"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus-Golden"=-



Version 2.130 (December 13, 2006)


%SYSTEM%\olnohdw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}"="astral"



Version 2.129 (December 12, 2006)


%SYSTEM%\qrzsyr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01b55afa-f451-474b-9e91-c35b24d02641}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{01b55afa-f451-474b-9e91-c35b24d02641}"="boob"

%SYSTEM%\rosdzop.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bb720bab-2f75-456b-a850-04d77b20f6b8}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bb720bab-2f75-456b-a850-04d77b20f6b8}"="impasse"

O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - C:\WINDOWS\system32\ixt0.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4d74aaa-a178-4463-846b-b4bc87a024e0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f4d74aaa-a178-4463-846b-b4bc87a024e0}]

O3 - Toolbar: Protection Bar - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - C:\Program Files\Video ActiveX Object\iesplugin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2}"=-



Version 2.128 (December 4, 2006)


%SYSTEM%\vcehaeb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d635a36-6b3c-4146-8625-f3aaf507bbf8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"="flammei"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"flammei"="{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"

%SYSTEM%\xqpauzx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2efa195-4785-4db1-9316-b48c64bb71da}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f2efa195-4785-4db1-9316-b48c64bb71da}"="blippers"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"blippers"="{f2efa195-4785-4db1-9316-b48c64bb71da}"

%SYSTEM%\mlraakb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}"="gloomily"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gloomily"="{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}"



Version 2.127 (December 3, 2006)


Now detect and remove: [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="kd???.exe"

O2 - BHO: (no name) - {1a1ddc19-5893-43ab-a73f-f41a0f34d115} - C:\Program Files\Video ActiveX Object\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]

O2 - BHO: (no name) - {67270207-b9ee-4d26-9270-860fdb060ca1} - C:\WINDOWS\system32\ixt0.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67270207-b9ee-4d26-9270-860fdb060ca1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67270207-b9ee-4d26-9270-860fdb060ca1}]



Version 2.126 (November 30, 2006)


Export of: [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="kd???.exe"

%PROGRAMFILES%\Video ActiveX Object\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video ActiveX Object] (C:\Program Files\Video ActiveX Object\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\Video ActiveX Object\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video ActiveX Object] (C:\Program Files\Video ActiveX Object\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\Brain Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brain Codec] (C:\Program Files\Brain Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\Key Generator\
%DESKTOP%\Key Generator.lnk
%STARTMENU%\Programs\Key Generator\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Key Generator] (C:\Program Files\Key Generator\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\My Pass Generator\
%DESKTOP%\My Pass Generator.lnk
%STARTMENU%\Programs\My Pass Generator\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Pass Generator] (C:\Program Files\My Pass Generator\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\VideoAccess\
%STARTMENU%\Programs\VideoAccess\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoAccess]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoAccess] (C:\Program Files\VideoAccess\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\VideoAccess]

O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}-C:\WINDOWS\System32\ixt0.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}]



Version 2.125 (November 27, 2006)



%SYSTEM%\xxfgmy.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{588599f4-de26-4c28-ba14-f4eb17e33481}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{588599f4-de26-4c28-ba14-f4eb17e33481}"="emptins"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"emptins"="{588599f4-de26-4c28-ba14-f4eb17e33481}"

%SYSTEM%\dbqlrij.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{af4fd984-a939-4c32-82b2-8bae7abe9aec}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{af4fd984-a939-4c32-82b2-8bae7abe9aec}"="benumbment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"benumbment"="{af4fd984-a939-4c32-82b2-8bae7abe9aec}"

%SYSTEM%\tpedvf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a01a98c-4f25-42e1-971a-185cf63569b2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1a01a98c-4f25-42e1-971a-185cf63569b2}"="expatriates"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"expatriates"="{1a01a98c-4f25-42e1-971a-185cf63569b2}"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus-Bursters 6.3.lnk
%STARTMENU%\Virus-Bursters 6.3.lnk
%STARTMENU%\Programs\Virus-Bursters\ (Already removed)
%DESKTOP%\Virus-Bursters.lnk (Already removed)
%PROGRAMFILES%\Virus-Bursters\ (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A66CC28-F0A2-FCBC-D3D5-1EA3001ED26A}] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{150D28AC-7C2D-4B57-B837-C74DCE7CC728}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{276D86B8-010B-4576-8444-9A670070A3F4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D9CAF75-4B36-455B-ADEF-0CFD7ADF3154}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38CD62AA-98AC-4B47-9CB8-8E1F108AD32F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41F834DA-AF4B-4C04-BD2E-9FA131FF39E5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48CE44BF-E439-46DE-8CD8-88CB5B3D6D6E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F7FA7BF-007C-46E6-A49C-B8E7373C046E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F412259-081E-4B21-815D-93AE1E71AE95}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78EA0C93-1AAA-4922-84F0-42CBA685F6BC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{887D7071-FB68-49F6-A77C-E12D0A83BF91}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ECEF347-16E8-45B3-BB6D-AE9DDFC4EC11}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9EE20753-220C-4A2C-87DC-F86FB78F3774}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A4BB2045-C8B4-4A9F-B509-7A626797B961}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BED38B7D-66E0-47B2-A7EF-8682B62828D6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D87A739B-AD9A-4973-B8C5-9D55B3EC0401}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EC6921C1-F723-49C9-B760-274DE8238ED6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C97C3B7C-E022-4FA8-B1A7-1C28270FFAFF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virus-bursters.exe] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus-Bursters] (C:\Program Files\Virus-Bursters\uninst.exe)
[HKEY_LOCAL_MACHINE\SOFTWARE\Virus-Bursters] (Already removed)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Virus-Bursters"="C:\Program Files\Virus-Bursters\virus-bursters.exe /h"



Version 2.124 (November 24, 2006)


O2 - BHO: (no name) - {ae18da4e-be15-4925-81bb-890c04af0200} - C:\Program Files\Gold Codec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{ae18da4e-be15-4925-81bb-890c04af0200}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae18da4e-be15-4925-81bb-890c04af0200}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ae18da4e-be15-4925-81bb-890c04af0200}]

O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Program Files\Perfect Codec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{74a49269-9779-48b4-a0e6-3a5af2a3ade6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74a49269-9779-48b4-a0e6-3a5af2a3ade6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{74a49269-9779-48b4-a0e6-3a5af2a3ade6}"=-

O3 - Toolbar: Protection Bar - {96ebbe6a-2864-4345-b32b-26ee9be524b5} - C:\Program Files\Gold Codec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{96ebbe6a-2864-4345-b32b-26ee9be524b5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{96ebbe6a-2864-4345-b32b-26ee9be524b5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{96ebbe6a-2864-4345-b32b-26ee9be524b5}"=-

%PROGRAMFILES%\Gold Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gold Codec] (C:\Program Files\Gold Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\Silver Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Silver Codec] (C:\Program Files\Silver Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.123 (November 20, 2006)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus-Bursters 6.2.lnk
%STARTMENU%\Virus-Bursters 6.2.lnk
%STARTMENU%\Programs\Virus-Bursters\
%DESKTOP%\Virus-Bursters.lnk
%PROGRAMFILES%\Virus-Bursters\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A66CC28-F0A2-FCBC-D3D5-1EA3001ED26A}] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0249BEB1-A2AA-45A3-9EC5-95D9C4A40A62}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{082DA6AF-F994-4C6C-A2B0-DFC3B3FF540A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0C9A71B1-8A8A-48A1-AA3F-0C83CE1C0BBD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0EF25077-DA22-4FF2-B6FF-6FC1C26F5740}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{20DC1F8E-4640-4FFF-9858-05E7B978CC71}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2613CF74-4FC5-4251-9F48-260496364852}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27D8CD06-82E3-4E1E-8917-86A9B3AE41F6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CAEFBCD-55A9-4A68-AA02-E69B12B3BE57}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{898272CF-3ACE-4A7B-98FA-9EB8DB8B26DC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8CBF5BAC-E609-4863-ABC9-68A7BD13B1D0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9981DDEF-81C4-4CC8-A5F2-62A7912D8037}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CB68DF7-F336-45A2-BDE2-5DCA3998986F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B4BB620F-3AE7-4910-8171-F9FC8120D9EF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D838D7A3-1551-4B32-BF7A-7F4F769BB885}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1751F23-00E6-4F6C-AD78-CA7D8A96FD3E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED639B1F-1B3F-473F-BD8D-6DE9C2D1972A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F83E8F99-AE49-45D6-92B4-59854BF0A759}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virus-bursters.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus-Bursters] (C:\Program Files\Virus-Bursters\uninst.exe)
[HKEY_LOCAL_MACHINE\SOFTWARE\Virus-Bursters]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Virus-Bursters"="C:\Program Files\Virus-Bursters\virus-bursters.exe /h"

%SYSTEM%\dcvwaah.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40dcff6e-af8d-4183-8ebe-a82270ac449e]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{40dcff6e-af8d-4183-8ebe-a82270ac449e}"="gimmicks"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gimmicks"="{40dcff6e-af8d-4183-8ebe-a82270ac449e}"

%SYSTEM%\fmrmhc.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0bad5052-665d-40d4-a9bd-a2891eaafb42}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0bad5052-665d-40d4-a9bd-a2891eaafb42}"="boucicault"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"boucicault"="{0bad5052-665d-40d4-a9bd-a2891eaafb42}"

%SYSTEM%\oebxpba.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4fc003c3-87a0-489c-85cd-878246eb2d18}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4fc003c3-87a0-489c-85cd-878246eb2d18}"="amaranthaceous"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"amaranthaceous"="{4fc003c3-87a0-489c-85cd-878246eb2d18}"



Version 2.122 (November 15, 2006)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiper 4.3.lnk
%STARTMENU%\MalwareWiper 4.3.lnk
%STARTMENU%\Programs\MalwareWiper\
%DESKTOP%\MalwareWiper.lnk
%PROGRAMFILES%\MalwareWiper\

HKLM\SOFTWARE\Classes\AppID\MalwareWipe.EXE (Already removed)
HKLM\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5} (Already removed)
HKLM\SOFTWARE\Classes\CLSID\{1FC4ADE1-15D3-057E-81D5-DD934DE6542E}
HKLM\SOFTWARE\Classes\Interface\{04DA0CE8-87C6-4379-9CBD-5D6E93C919E8}
HKLM\SOFTWARE\Classes\Interface\{0678CAB9-7825-467E-9310-CDD2DCA855D0}
HKLM\SOFTWARE\Classes\Interface\{1386F568-F1AB-477D-B69E-31D66B6E4DAA}
HKLM\SOFTWARE\Classes\Interface\{210E3B48-776B-4F4B-B80A-2BB59F1A676D}
HKLM\SOFTWARE\Classes\Interface\{2E3C5BE8-3EA7-48A7-97FA-7E2AB0A88392}
HKLM\SOFTWARE\Classes\Interface\{576BB1E3-B26D-4BCB-A0BD-B49FF2469936}
HKLM\SOFTWARE\Classes\Interface\{5F8BD6DC-6D30-4A6F-9D07-3822DFA605D7}
HKLM\SOFTWARE\Classes\Interface\{694E0F65-5EF7-40FB-9412-48AFCE704720}
HKLM\SOFTWARE\Classes\Interface\{74878382-B258-484B-A614-475D8DCF104B}
HKLM\SOFTWARE\Classes\Interface\{7B8A51F7-0700-4CEB-978E-E0A3C88CB4B4}
HKLM\SOFTWARE\Classes\Interface\{87FF9647-1710-4EB6-97C9-65484F9C61E9}
HKLM\SOFTWARE\Classes\Interface\{A7358DCF-6343-45AE-930D-5C2BB96B9116}
HKLM\SOFTWARE\Classes\Interface\{B4BFACA9-37BA-45BC-8EE6-6F9910651B0B}
HKLM\SOFTWARE\Classes\Interface\{BE18EBF9-4F98-4333-8DD2-AEBA2911A80B}
HKLM\SOFTWARE\Classes\Interface\{DDC17036-3DE8-4FEB-948E-D225CF5BCC95}
HKLM\SOFTWARE\Classes\Interface\{E8194604-B6D1-4D63-ABC7-8C2D89E6D497}
HKLM\SOFTWARE\Classes\TypeLib\{96467F12-0518-4E85-AC6A-4858017F1400}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiper.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiper] (C:\Program Files\MalwareWiper\uninst.exe)
HKLM\SOFTWARE\MalwareWiper

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"MalwareWiper"=-


%PROGRAMFILES%\JPEG Encoder\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JPEGEncoder.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JPEG Encoder] (C:\Program Files\JPEG Encoder\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\Perfect Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Perfect Codec] (C:\Program Files\Perfect Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\Super Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Codec] (C:\Program Files\Super Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.121 (November 14, 2006)


Update: Bug correction in CTDrive Fix routine (causes a jump to the scan part while fixing)

O2 - BHO: (no name) - {192c5b4a-3efd-40c7-9f99-c472deb8efc0} - C:\Program Files\QualityCodec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]

O2 - BHO: (no name) - {2810fba5-55ec-4bee-8263-0e2fa5883768} - C:\Program Files\QualityCodec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{2810fba5-55ec-4bee-8263-0e2fa5883768}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2810fba5-55ec-4bee-8263-0e2fa5883768}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2810fba5-55ec-4bee-8263-0e2fa5883768}]

O2 - BHO: (no name) - {4734044c-7427-43d8-adbe-df942e52bef2} - C:\Program Files\QualityCodec\isaddon.dll (file missing)
[-HKEY_CLASSES_ROOT\CLSID\{4734044c-7427-43d8-adbe-df942e52bef2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4734044c-7427-43d8-adbe-df942e52bef2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4734044c-7427-43d8-adbe-df942e52bef2}]

O3 - Toolbar: Protection Bar - {bf1ced2c-4b3f-4079-a330-864eda5a4cff} - C:\Program Files\QualityCodec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{bf1ced2c-4b3f-4079-a330-864eda5a4cff}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf1ced2c-4b3f-4079-a330-864eda5a4cff}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf1ced2c-4b3f-4079-a330-864eda5a4cff}"=-

%SYSTEM%\jbtazy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ab340860-fd81-4a65-b345-82eb77a66b5e}"="featherweed"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"featherweed"="{ab340860-fd81-4a65-b345-82eb77a66b5e}"

%SYSTEM%\cfltygd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff170564-36c8-43f7-9100-559e166405cf}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ff170564-36c8-43f7-9100-559e166405cf}"="cussers"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"cussers"="{ff170564-36c8-43f7-9100-559e166405cf}"



Version 2.120 (November 09, 2006)


%SYSTEM%\yosdjh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"anatolian"="{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"anatolian"="{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}"

O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} - C:\WINDOWS\system32\ixt?.dll
[-HKEY_CLASSES_ROOT\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]

O2 - BHO: (no name) - {274c0420-ebe0-4f1d-b473-edd1aa9b85dd} - C:\Program Files\iVideoCodec\isaddon.dll
O2 - BHO: (no name) - {274c0420-ebe0-4f1d-b473-edd1aa9b85dd} - C:\Program Files\QualityCodec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]

%PROGRAMFILES%\QualityCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QualityCodec] (C:\Program Files\QualityCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%USERPROFILE%\StartMenu\Programs\FreeVideo\
%PROGRAMFILES%\FreeVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeVideo] (C:\Program Files\FreeVideo\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\FreeVideo]

%PROGRAMFILES%\EliteCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EliteCodec] (C:\Program Files\EliteCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.119 (November 03, 2006)


Update: Generic Renos Fix 1.9

%SYSTEM%\sacskza.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01d8d081-0f76-4ab5-b5e4-9b23a709670e}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"detachments"="{01d8d081-0f76-4ab5-b5e4-9b23a709670e}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{01d8d081-0f76-4ab5-b5e4-9b23a709670e}"="detachments"

%SYSTEM%\impgsje.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"archenteric"="{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}"="archenteric"

%SYSTEM%\okkmtv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bonspells"="{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"="bonspells"



Version 2.118 (November 02, 2006)


%PROGRAMFILES%\iVideoCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iVideoCodec] (C:\Program Files\iVideoCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)


%PROGRAMFILES%\VidCodecs\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VidCodecs] (C:\Program Files\VidCodecs\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.117 (October 29, 2006)


O2 - BHO: (no name) - {8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d} - C:\Program Files\TrueCodec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d}]

%SYSTEM%\drv???.dll (filename retrieved from registry)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTDrive"=-



Version 2.116 (October 29, 2006)


%WINDOWS%\accesss.exe
%WINDOWS%\astctl32.ocx
%WINDOWS%\avpcc.dll
%WINDOWS%\clrssn.exe
%WINDOWS%\cpan.dll
%WINDOWS%\dialup.exe
%WINDOWS%\inetdctr.dll
%WINDOWS%\mtwirl32.dll
%WINDOWS%\notepad32.exe
%WINDOWS%\olehelp.exe
%WINDOWS%\runwin32.exe
%WINDOWS%\spp3.dll
%WINDOWS%\systeem.exe
%WINDOWS%\systemcritical.exe
%WINDOWS%\time.exe
%WINDOWS%\users32.exe
%WINDOWS%\waol.exe
%WINDOWS%\win32e.exe
%WINDOWS%\win64.exe
%WINDOWS%\winajbm.dll
%WINDOWS%\window.exe
%WINDOWS%\wininet32.exe
%WINDOWS%\winmgnt.exe
%WINDOWS%\x.exe
%WINDOWS%\xplugin.dll
%WINDOWS%\xxxvideo.hta
%WINDOWS%\y.exe
%SYSTEM%\ace16win.dll
%SYSTEM%\anti_troj.exe
%SYSTEM%\dload.exe
%SYSTEM%\iewd.exe
%SYSTEM%\kernels64.exe (Already removed)
%SYSTEM%\lfd.dat (Already removed)
%SYSTEM%\mpsegment.exe
%SYSTEM%\msmapi32.exe
%SYSTEM%\msmapi32.exe.MANIFEST
%SYSTEM%\msmsn.exe
%SYSTEM%\msvol.tlb (Already removed)
%SYSTEM%\ncompat.tlb (Already removed)
%SYSTEM%\netstat2.exe
%SYSTEM%\oiso.bin (Already removed)
%SYSTEM%\ot.ico (Already removed)
%SYSTEM%\pcf.pdf
%SYSTEM%\perfont.exe
%SYSTEM%\performent202.dll
%SYSTEM%\POPCORN72.EXE
%SYSTEM%\proqlaim.exe
%SYSTEM%\ts.ico (Already removed)
%SYSTEM%\vxgamet1.exe (Already removed)
%SYSTEM%\VXH8JKDQ2.EXE (Already removed)
%SYSTEM%\VXH8JKDQ6.EXE (Already removed)
%SYSTEM%\win32hp.dll
%SYSTEM%\winmuse.exe (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\asgp32.ASGP]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11904ce8-632a-4856-a7cc-00b33fe71bd8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15ACE85C-0BB1-42d1-9E32-07EB0506675A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1b68470c-2def-493b-8a4a-8e2d81be4ea5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1c4da27d-4d52-4465-a089-98e01bb725ca}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{202a961f-23ae-42b1-9505-ffe3c818d717}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e246fae-8420-11d9-870d-000c2917de7f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5753791b-f607-48ca-814e-91c14d081f9e}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7070a8f9-08a4-ca47-0ab0-1eb9e4ee1f3b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{746455fe-d059-47e7-af0e-140e03f5a447}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7a7e6d97-b492-4884-9abb-c31281dcc4f2}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{860c2f6b-ca82-4282-9187-beccbb66f0af}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87185e78-a61b-4db3-965a-3235bbd7a622}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8dc8f96d-34f7-1501-a2a4-631341aa3ac1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9c5875b8-93f3-429d-ff34-660b206d897a}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a2595f37-48d0-46a1-9b51-478591a97764}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a6f42cad-2559-48df-af30-89e480af5dfa}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b212d577-05b7-4963-911e-4a8588160dfa}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d1ac752e-883f-4ed8-8828-b618c3a72152}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e2b2b5a1-b48c-4886-a318-723916a01024}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e6d5237d-a6c7-4c83-a67f-f9f15586fa62}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fcaddc14-bd46-408a-9842-cdbe1c6d37eb}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fe2d25c1-c1db-4b5e-9390-af1cb5302f32}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antispyware Soldier_is1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareSheriff_is1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TitanShield Antispyware_is1] (Already removed)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF\0000\Control]
"ActiveService"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF\0000\Control]
"ActiveService"=-

O2 - BHO: (no name) - {c3703265-4671-4858-92a4-cba6a7b3bb45} - C:\WINDOWS\system32\ixt3.dll
[-HKEY_CLASSES_ROOT\CLSID\{c3703265-4671-4858-92a4-cba6a7b3bb45}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c3703265-4671-4858-92a4-cba6a7b3bb45}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3703265-4671-4858-92a4-cba6a7b3bb45}]

%SYSTEM%\rrtcany.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27321538-5739-4aa1-b84c-7d18e4383f1f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ferrateen"="{27321538-5739-4aa1-b84c-7d18e4383f1f}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27321538-5739-4aa1-b84c-7d18e4383f1f}"="ferrateen"

%SYSTEM%\veklo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d9eb558-0666-479e-868a-21b1d1a53bd1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"clamoring"="{0d9eb558-0666-479e-868a-21b1d1a53bd1}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0d9eb558-0666-479e-868a-21b1d1a53bd1}"="clamoring"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusBursters 6.2.lnk
%USERPROFILE%\StartMenu\VirusBursters 6.2.lnk
%USERPROFILE%\StartMenu\Programs\VirusBursters\
%USERPROFILE%\Desktop\VirusBursters.lnk
%PROGRAMFILES%\VirusBursters\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A66CC28-F0A2-FCBC-D3D5-1EA3001ED26A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02313722-BB43-4C84-80A2-7CEDFC3F8560}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A03153E-AE2A-47FE-BBA3-3333C0EEEB86}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{13854DA2-8414-4007-9693-2B6E6002520E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1DF2A595-BB53-46D4-9EED-1343E066C2B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21EFA4BF-6BAC-43E9-9465-9DDB4AC2967E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CB87422-057A-4FFC-A518-6A728D6F5F65}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52B75F3F-0016-4002-9A3A-B68BC9501ED1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DDA751B-CA62-41C6-B622-EA4B4C2E51F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{88BDD61D-AC47-4D9E-A3ED-1CAA575593E6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A09DFAEF-BFA3-47CA-9479-D7EC79342146}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B70B489C-F0D5-4DD9-A2BA-9B6DBCF5090A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B889DE48-EC10-4278-B3FF-76FEB7449215}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C9CA446E-0484-4647-BBF0-3C129C42047C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7DE2292-04DD-48FC-B250-5E9BFE6BB959}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9B659A0-6F32-4D69-A7D0-29A0B8CDDC16}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13560C-D18C-4BE6-AE80-EBEFC6E5AD3C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACF3DAB0-D308-4B7A-BFE3-E6C0FAFEB1E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virusbursters.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusBursters] (C:\Program Files\VirusBursters\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusBursters]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusBursters"=-



Version 2.115 (October 28, 2006)


O3 - Toolbar: Protection Bar - {1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} - C:\Program Files\VideoCompressionCodec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f}"=-



Version 2.114 (October 26, 2006)


%PROGRAMFILES%\TrueCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrueCodec] (C:\Program Files\TrueCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\VideoKeyCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoKeyCodec] (C:\Program Files\VideoKeyCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.113 (October 23, 2006)


O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\VideoCompressionCodec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{7b4d79df-9ef0-429d-a0e9-d9b138c6a53b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b4d79df-9ef0-429d-a0e9-d9b138c6a53b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7b4d79df-9ef0-429d-a0e9-d9b138c6a53b}]

O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\PowerCodec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{8aed5df3-6e0b-4930-b1a5-f8aa8d757497}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8aed5df3-6e0b-4930-b1a5-f8aa8d757497}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8aed5df3-6e0b-4930-b1a5-f8aa8d757497}"=-



Version 2.112 (October 20, 2006)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PornPass Manager] (C:\Program Files\PornPass Manager\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%USERPROFILE%\StartMenu\Programs\PornPass Manager\
%USERPROFILE%\Desktop\PornPass Manager.lnk
%PROGRAMFILES%\PornPass Manager\



Version 2.111 (October 19, 2006)


%PROGRAMFILES%\PowerCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerCodec] (C:\Program Files\PowerCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%PROGRAMFILES%\VideoCompressionCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoCompressionCodec] (C:\Program Files\VideoCompressionCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVermins 2.1.lnk
%USERPROFILE%\StartMenu\AntiVermins 2.1.lnk
%USERPROFILE%\StartMenu\Programs\AntiVermins\
%USERPROFILE%\Desktop\AntiVermins.lnk
%PROGRAMFILES%\AntiVermins\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{663DE629-4FFD-A944-6F0A-64F98E925B62}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE87CAF-1C8E-43C7-A476-5AF1A2F5A43F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD726EC-F1F5-4210-9011-EE6B5332A279}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1EFD4366-6676-4AF7-A88A-872A49E2601D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B3FA480-138E-47E6-B79A-9A0F7B2846D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E186CE2-1ABB-45D6-A4B9-4FCD11FBB014}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4AF8E04F-0D5E-4C3F-BA67-81B685584C12}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6C80C5B2-4748-411C-8120-09426F8ED212}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{748C9204-6C92-485B-8BF8-3AF7ECF03CDE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B6A0AA8A-7CB1-44F0-ACE7-7A69739C8674}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C27D97E9-004B-4F4F-A5B0-B7188DDAE024}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C3176A2C-3119-4F7F-B847-62B5EE6763E5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAC16E1A-D86B-428A-BB7B-65F2D2BFC160}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD369501-EDE4-4E99-8728-7C9E4BBE6BE8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAC1ACCD-7790-4991-A9D2-550806D6D9C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF2AA606-B72E-4A1B-B076-8B148661F3B7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9476885-40EB-4405-878A-193BAF18CE9B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{13693777-5B9D-4AFC-99F1-650F569A0EB0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVermins.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVermins] (C:\Program Files\AntiVermins\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVermins]



Version 2.110 (October 16, 2006)


O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca}-C:\WINDOWS\System32\ixt0.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a43385f0-7113-496d-96d7-b9b550e3fcca}]

%PROGRAMFILES%\HQVideoCodec\
[-HKEY_CURRENT_USER\SOFTWARE\HQVideoCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HQVideoCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HQVideoCodec] (C:\Program Files\HQVideoCodec\uninst.exe)

O2 - BHO: (no name) - {d869742a-e5d2-4624-96c7-aae26170665e} - C:\Program Files\HQVideoCodec\isaddon.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d869742a-e5d2-4624-96c7-aae26170665e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d869742a-e5d2-4624-96c7-aae26170665e}]

O3 - Toolbar: Protection Bar - {44d22a64-2399-4edf-8b32-f2c729c1e8a7} - C:\Program Files\HQVideoCodec\iesplugin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44d22a64-2399-4edf-8b32-f2c729c1e8a7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{44d22a64-2399-4edf-8b32-f2c729c1e8a7}"=-



Version 2.109 (October 10, 2006)


%PROGRAMFILES%\MMediaCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MMediaCodec] (C:\Program Files\MMediaCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.108 (October 10, 2006)


Update: Generic Renos Fix 1.8

%SYSTEM%\qnusjji.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06fe8138-6c67-484f-ab1f-42abddd2cbb6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"breakneck"="{06fe8138-6c67-484f-ab1f-42abddd2cbb6}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{06fe8138-6c67-484f-ab1f-42abddd2cbb6}"="breakneck"



Version 2.107 (October 09, 2006)


%SYSTEM%\dpfwu.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="contrabandists"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"contrabandists"="{dfa61db1-388e-4c87-8d56-540fa229bcb4}"

%SYSTEM%\tazth.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{f31aee4a-1530-4fef-8537-79c6973bff9a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f31aee4a-1530-4fef-8537-79c6973bff9a}"="gaonic"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gaonic"="{f31aee4a-1530-4fef-8537-79c6973bff9a}"

%SYSTEM%\ficqv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18c3fa26-192e-4c17-9c0f-76dc9b56c0c2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{18c3fa26-192e-4c17-9c0f-76dc9b56c0c2}"="heteropodous"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"heteropodous"="{18c3fa26-192e-4c17-9c0f-76dc9b56c0c2}"



Version 2.106 (October 09, 2006)


%SYSTEM%\rjxdexau.exe

%PROGRAMFILES%\MediaCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaCodec] (C:\Program Files\MediaCodec\uninst.exe)



Version 2.105 (October 05, 2006)


%PROGRAMFILES%\SoftCodec\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftCodec] (C:\Program Files\SoftCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"isamonitor.exe"=-



Version 2.104 (October 01, 2006)


%WINDOWS%\yod.htm
%SYSTEM%\lfd.dat
%SYSTEM%\oiso.bin
%SYSTEM%\sumsw32.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}]



Version 2.103 (September 30, 2006)


%PROGRAMFILES%\iMediaCodec\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iMediaCodec] (C:\Program Files\iMediaCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Spy-Heal 2.1.lnk
%USERPROFILE%\StartMenu\Spy-Heal 2.1.lnk
%USERPROFILE%\StartMenu\Programs\Spy-Heal\
%USERPROFILE%\Desktop\Spy-Heal.lnk
%PROGRAMFILES%\Spy-Heal\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{96E6B1C3-B5D0-89CC-4909-92D85A48B1A0}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{131706D3-7294-4EDC-BA4B-5290BAB9FB36}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{241D6A46-E756-47C2-A95D-CB63313A5FAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E0ED423-67B0-4C73-BADB-57D673A92E92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41417555-4052-47C1-A7DF-C5A2B869F98E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4AE0048E-4C88-43DE-BBCC-2530A2C24634}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{544F9A30-7A37-4E83-95BF-704131C6B928}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58F394DC-8F9C-41AF-99A8-0C5DBD830512}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D8D02FB-2877-40CF-8325-B6FFEC0811DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7FB0A17F-60E7-47C6-BBF8-00A0427CF8EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85953437-B661-4DC1-98A6-FC7005B710FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87664F4C-697D-437E-BF90-2FD7C6C0B04C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{984281D2-E2E0-442D-A2DD-88638F2CE04C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9D5ADF27-B3F9-493D-A15E-AB019B9FD18B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9DE6DA81-E460-4E25-937D-A3EE1E6FCA27}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF215DAD-8E52-4C75-B779-5093B3855E79}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF884BC1-EE64-4E8B-AE3D-84037A0D1606}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2A762197-1159-441E-BE28-4160C5494A66}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Spy-Heal.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spy-Heal] (C:\Program Files\Spy-Heal\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Spy-Heal]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spy-Heal"=-



Version 2.102 (September 29, 2006)


%ALLUSERPROFILE%\Start Menu\Programs\Startup\Uninstall.exe

%PROGRAMFILES%\VideosCodec\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideosCodec] (C:\Program Files\VideosCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.101 (September 28, 2006)


%SYSTEM%\httge.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7be183d2-a42d-4915-bf60-ec86fbf002cf}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7be183d2-a42d-4915-bf60-ec86fbf002cf}"="horologium"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"horologium"="{7be183d2-a42d-4915-bf60-ec86fbf002cf}"

%SYSTEM%\gqagksr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b166be07-30a4-4d38-b781-44528a630706}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b166be07-30a4-4d38-b781-44528a630706}"="hydrodictyon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hydrodictyon"="{b166be07-30a4-4d38-b781-44528a630706}"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusBurster 6.2.lnk
%USERPROFILE%\StartMenu\VirusBurster 6.2.lnk
%USERPROFILE%\StartMenu\Programs\VirusBurster\
%USERPROFILE%\Desktop\VirusBurster.lnk
%PROGRAMFILES%\VirusBurster\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D6ECDA42-AD6F-F8C3-03EA-5834841ADEC3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0065CDBC-2439-4365-A7E7-BF5B853BF49D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19DACF08-A207-4271-AA22-C138F512E787}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E37C978-9E24-42FA-B021-B56CAAFDB694}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4130008C-5697-4EF5-9EDE-EF8F9F10D524}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F4A0564-17DE-4EB2-B29E-6D2E167A3BE0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B067ED9-4AEC-474E-B67E-85EF417D68BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9188A88D-3D41-4EB6-A7D8-0F6A5266F685}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B660CDE9-526E-41FE-AB41-773D78BEE31E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF8A0E53-F417-413A-B849-B5C0086EEF8A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C36464A1-2D2F-4804-AAF6-F5BD62536ADB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA74BAFC-1F0C-49B1-8A76-5D55085E71FB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0722752-35B5-44E1-A14A-E2A44C41F509}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D648067C-E5D2-4BB8-AD86-A993B8793A52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE2EAC90-8B01-49D4-B46C-8E02BDA1F3B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7F932D6-A6BE-4273-9950-ECBD72170DBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD34EB96-89FA-43CC-9C37-D1D5B099D28F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A569F6C9-29F0-43BC-80CF-6BA138C66108}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virusburster.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusBurster] (C:\Program Files\VirusBurster\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusBurster]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusBurster"=-




Version 2.100 (September 25, 2006)


%WINDIR%\aapfr.exe
%WINDIR%\processes.txt
%WINDIR%\system\eooyt.exe
%WINDIR%\system\processes.txt
%SYSTEM%\rtwwf.exe
%WINDIR%\system\processes.txt
%USERPROFILE%\xxfep.exe
%WINDIR%\system\processes.txt
%USERPROFILE%\Start Menu\Programs\Startup\rAggge.exe
%USERPROFILE%\Start Menu\Programs\Startup\processes.txt
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\qwwyyu.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\processes.txt



Version 2.99 (September 23, 2006)


%PROGRAMFILES%\WinMediaCodec\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinMediaCodec] (C:\Program Files\WinMediaCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.98 (September 22, 2006)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HQvideo]
[-HKEY_CURRENT_USER\Software\HQvideo]
%USERPROFILE%\StartMenu\Programs\HQvideo\
%PROGRAMFILES%\HQvideo\



Version 2.97 (September 21, 2006)


%PROGRAMFILES%\MPVIDEOCODEC\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (New)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPVIDEOCODEC] (C:\Program Files\MPVIDEOCODEC\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Version 2.96 (September 20, 2006)


Update: Generic Renos Fix 1.7
Added: lzx32 driver detection (thanks LonnyRJones)



Version 2.95 (September 20, 2006)


%SYSTEM%\titiau.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1559e6c1-7e5e-4461-9457-6a2dea85eb9f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"eeler"="{1559e6c1-7e5e-4461-9457-6a2dea85eb9f}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1559e6c1-7e5e-4461-9457-6a2dea85eb9f}"="eeler"

%SYSTEM%\zphnok.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70305bc2-b289-4209-a344-be21f22bc930}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"equestre"="{70305bc2-b289-4209-a344-be21f22bc930}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{70305bc2-b289-4209-a344-be21f22bc930}"="equestre"

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\vb 6.1.lnk
%USERPROFILE%\StartMenu\vb 6.1.lnk
%USERPROFILE%\StartMenu\Programs\vb\
%USERPROFILE%\Desktop\vb.lnk
%PROGRAMFILES%\vb\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0354A901-C606-4DCC-8EA3-4F3383ECE67C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{11ED5DDF-90D0-45C1-BE2B-C9C4F98CCFE2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1FEB28BA-21B6-46F3-948A-D7CA11654FE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{340B5D33-4A0C-4673-94FA-B88ECC48773E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{453B991D-6B23-48CF-A3B0-2214F437CCB0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5AC65D7D-C00C-47A4-83F7-F81073C39B25}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{657D5DE0-6497-4040-B604-F38C9411F64D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A7D5862-7B00-4270-B456-CDC6779A79DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{940664C7-DE44-4B8F-A05D-FD70CAB75F2C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7512CD1-CFDE-4498-ADBD-14B38062A478}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CABABC4B-5B0F-4297-9D85-72E93616ED55}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CCA1E17E-2BEE-4D53-8D00-7ADB5B35145A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF1D16BA-2CE6-429A-A63A-3CF44D81A950}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E56B4B91-E548-4E89-97AC-E9630D22A2E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC105E0D-AE24-43F2-89AA-E8AB8F96EF6E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD99520A-E900-4F8D-9092-22705622D2D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{03F89BF1-127B-44F3-B6F4-5A18FEA674CD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\vb.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vb] (%PROGRAMFILES%\vb\uninst.exe")
[-HKEY_LOCAL_MACHINE\SOFTWARE\vb]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vb"=-






Version 2.94 (September 19, 2006)


Update: filename change, compression removed download.exe -> SmiUpdate.exe



Version 2.93 (September 18, 2006)


Added: msguard driver detection



Version 2.92 (September 18, 2006)


Added: pe386 driver detection



Version 2.91 (September 17, 2006)


O4 - HKLM\..\Run: [bikini] bikini.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bikini"=-
%SYSTEM%\bikini.exe

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\X Password Generator] (C:\Program Files\X Password Generator\uninst.exe]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion]
"ProgramVersion"=-

%USERPROFILE%\Desktop\X Password Generator.lnk
%USERPROFILE%\StartMenu\Programs\X Password Generator\
%PROGRAMFILES%\X Password Generator\

%USERPROFILE%\StartMenu\Programs\X Password Manager\



Version 2.90 (September 16, 2006)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent]
is not removed anymore. This can be a legit key. (Thanks to Noahdfear)

%PROGRAMFILES%\strCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\strCodec] (C:\Program Files\strCodec\uninst.exe)



Version 2.89 (September 16, 2006)


Update: Option 4 Check for Updates added



Version 2.88 (September 14, 2006)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Safety Alerter 2006]

%SYSTEM%\qxfgcg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2be26361-58a2-4836-be57-b838f02fec3f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2be26361-58a2-4836-be57-b838f02fec3f}"="astrogeology"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"astrogeology"="{2be26361-58a2-4836-be57-b838f02fec3f}"

%SYSTEM%\syycum.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6076d2b1-634c-4685-843b-f826045ea5dc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6076d2b1-634c-4685-843b-f826045ea5dc}"="hemadynamometer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hemadynamometer"="{6076d2b1-634c-4685-843b-f826045ea5dc}"

Some Virus-Burst's CLSID have changed:
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D5364E2-8FD5-4AEE-8353-79ABE11BC89B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{111792AF-85B4-4768-AB91-682174B14B90}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1F2FC7B3-F2A0-4717-96B4-01D787DA9949}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{230E8C2A-1317-49FD-A022-4E68AED75668}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E64DCDD-94BB-4CAB-A93A-4416A3585DA0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E8641B2-0EA7-43B4-B8B5-895F155D9A9D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423FA7B8-5671-41DD-9C4D-B36607F31BCE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4259549C-361C-471D-BBCD-90671B818338}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{57859C9A-F115-4074-B7BC-AD69711EF51A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{707B2F9D-B855-4730-BB5D-44669B4F11E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87172D4B-FA72-406F-996E-2C6817B8E1FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9EC1C26F-0480-4BBC-BC69-7AC270388D0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C61736BF-F408-4475-B41D-8DDD96F86342}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D9037DA6-C9DF-4FCB-9C2E-2A1F10786FEA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA457340-9643-476D-A41A-09496677B2A3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB94E265-AC37-40C1-A656-044F38ED31D6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C17EB50A-667E-43B4-A53E-5B73F46AA009}]



Version 2.87 (September 10, 2006)


%DESKTOP%\Virus-Burst.lnk
%STARTMENU%\Virus-Burst 6.1.lnk
%STARTMENU%\Programs\Virus-Burst\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus-Burst 6.1.lnk
%PROGRAMFILES%\Virus-Burst\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCFB2B33-F4DB-B63D-ABDC-C7384ED93B34}] (same as VirusBurst)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{016859C2-97B6-45FC-816B-A3B91BA10A0F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{03713ADE-819C-43D9-B138-67828D4C0405}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BDF8F38-347C-4810-BDA6-2F85C1050B26}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18A1A6BB-8AE3-47E3-B9D4-75ABFE0CAC03}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D1254A1-4A1A-4339-9DE5-D05CADD5C44C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F34C08C-E0AF-4EB2-AFCF-3A13DC489FA6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D486E8-1932-492D-B1BD-B4D638BEBD84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49E2EB9D-A5E6-450E-9708-251876BF3E7F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{68C625EA-B8E3-4FC1-9F6E-8A1B50AA9C8C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F821290-E277-4F87-B4BD-AE48564EF21D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BA6B541-EB04-44C9-9156-9573DB5345A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A8718256-70C8-4914-8F64-B8B9C1A64AAA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C3A42538-303B-4541-915D-C79AD9C75EB8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C48AE974-0D27-47D6-A3E9-881CF3301F72}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA02B168-8841-4248-BF22-67E2EC5958C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E505FB9B-6CB3-44C5-9F0E-B01121076CC9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00B3D2B1-1EAD-4611-A348-9ECBC4C565A7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Virus-Burst.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus-Burst] (Uninstaller = %PROGRAMFILES%\Virus-Burst\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent] (same as VirusBurst, SpywareQuake...)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Licenses] (same as SpyFalcon, SpywareQuake...)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Virus-Burst]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Virus-Burst"="C:\Program Files\Virus-Burst\Virus-Burst.exe /h"



Version 2.86 (September 10, 2006)


%PROGRAMFILES%\iCodecPack\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iCodecPack] (Uninstaller = %PROGRAMFILES%\iCodecPack\uninst.exe)

%SYSTEM%\wuwbxp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{168cf174-6dab-461c-a761-a7adfa5a5719}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"campy"="{168cf174-6dab-461c-a761-a7adfa5a5719}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{168cf174-6dab-461c-a761-a7adfa5a5719}"="campy"

O3 - Toolbar: Protection Bar - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - C:\Program Files\PCODEC\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}"=-

%SYSTEM%\jpqet.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6e603242-2ef7-4f20-8d8c-ede065595a9b}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"deterioraton"="{6e603242-2ef7-4f20-8d8c-ede065595a9b}"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"deterioraton"="{6e603242-2ef7-4f20-8d8c-ede065595a9b}"

%SYSTEM%\kfhrvq.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{39d23dba-a362-4803-b26c-5f2cb46e669b}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ecgfb"="{39d23dba-a362-4803-b26c-5f2cb46e669b}"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"ecgfb"="{39d23dba-a362-4803-b26c-5f2cb46e669b}"

%SYSTEM%\xtgwjrm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4eb548e5-1fb1-4f83-b49f-a3101fe5fc97}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"grindelwald"="{4eb548e5-1fb1-4f83-b49f-a3101fe5fc97}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4eb548e5-1fb1-4f83-b49f-a3101fe5fc97}"="grindelwald"

%SYSTEM%\oqabf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4d993022-0899-4599-b4b6-0f887d0802e6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"considerateness"="{4d993022-0899-4599-b4b6-0f887d0802e6}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4d993022-0899-4599-b4b6-0f887d0802e6}"="considerateness"

%PROGRAMFILES%\VirusBlast\
%DESKTOP%\VirusBlast v5.0.lnk
%USERPROFILE%\StartMenu\VirusBlast v5.0.lnk
%USERPROFILE%\StartMenu\Programs\VirusBlast\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusBlast v5.0.lnk
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ad-protect.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEControl.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{490E7D57-1FC1-4ea6-BD52-483B7271B223}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DA1990B-9BCA-4c80-AEFB-11A40FA849F9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D0FAB5C-2BE4-4126-A28E-828FEBCE1E55}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F6FE2C2-6040-4645-9053-7F689AFFE176}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9DA04BBD-71BB-020C-436E-42FECBB98F05}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6B4AB50-F423-4EE6-9839-B35DCFCDFA49}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1131081D-81ED-46F0-8B03-B728AEAFFD12}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{214345B8-BB69-498D-A168-29F58F15D806}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6B4AB50-F423-4EE6-9839-B35DCFCDFA49}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{283ED043-D403-4808-BF28-FCDE29DCF1FB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{80ED1EB2-55FB-4434-BD41-E1645A370158}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEControl.IEExtension]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEControl.IEExtension.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VB.Server]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VB.Server.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusBlast.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F6FE2C2-6040-4645-9053-7F689AFFE176}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusBlast] (Uninstaller = %PROGRAMFILES%\VirusBlast\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent] (same as VirusBurst, SpywareQuake...)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Licenses] (same as SpyFalcon, SpywareQuake...)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusBlast]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusBlast"="C:\Program Files\VirusBlast\VirusBlast.exe /s"



Version 2.85 (September 09, 2006)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\Cerberus.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (same as MalwareWipe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{020B1227-417D-4682-9AC3-61F43CB5B6B1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{125494B2-ACAD-414c-98B9-452F3EF7703A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20A3D913-30EF-4e69-B3F7-93B3F1FB9D5C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3D00A39C-655B-428b-AEB2-2FBA03DCC49C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{408F660A-9465-44a3-B557-8709DFD992BC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5F6BBD8A-18CF-4d55-8B4C-C9B4C9328DFE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C56B6CE-C53F-44c4-9BDC-A9BC1711D05A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EE6BF73-B370-4d13-9126-EB0071178F2E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97F56E12-C706-4aeb-9FFB-133C05EE5D38}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB7E700-4E48-476d-B75C-6F47606BE988}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CBCACA58-1AEE-4600-8CF0-E8B30BFF1535}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D6D64CDF-0363-4261-B723-29A3AF365E1D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27ED4AC2-B6D8-4079-9831-017A100B391E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3F6D6C35-FB73-45E6-9473-BB4CC25CE019}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{715D709B-2B10-42FA-A069-297D25D93601}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{872C1B1E-3CF0-4D3A-95E5-A0C662D2854C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{886B1D08-B404-40F0-AA18-4E416682A2E9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B5F65CF-0B0A-4291-8DA2-86D7F7B0A6DB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{925B0211-A1C1-4712-8FCA-5F5B8101736D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B01E37C4-5497-4D58-9FFD-D5653B8DC866}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CCAA201C-C48D-48A8-A1E8-846562CBF1C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D483521B-D5CC-43FF-A45A-9BE4A8E6606E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED2AFF47-B7BE-4273-A203-C796E87F72D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F0FA7ED9-5A0A-4374-B63E-BEBAFD52192E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5DEE77C-87EB-4E00-BBF9-8CBF3BDEA7AF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB5DDAB7-6AA5-4E97-9541-5A75ADDF4ABA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FDDF521B-0EBE-4D15-838C-73E2D851161B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FF609434-EB47-481B-BA0E-1D2B467629A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{60F94D7D-563E-4942-B5EC-2DE9C135C139}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Cerberus.EngineListener]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Cerberus.EngineListener.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Cerberus.Scanner]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Cerberus.Scanner.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Cerberus.ThreatCollection]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Cerberus.ThreatCollection.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Backup.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.IgnoreList]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.IgnoreList.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Log]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Log.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.LogRecord]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.LogRecord.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Paths]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Paths.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Quarantine]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Quarantine.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.RunAs]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.RunAs.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.SearchItem]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.SearchItem.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Threat]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Engine.Threat.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntivirusGolden.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntivirusGolden] (Uninstaller = %PROGRAMFILES%\AntivirusGolden\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent] (same as VirusBurst, SpywareQuake...)
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusGolden]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Licenses] (same as SpyFalcon, SpywareQuake...)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntivirusGolden"="C:\Program Files\AntivirusGolden\AntivirusGolden.exe /h"

%PROGRAMFILES%\AntivirusGolden\
%DESKTOP%\AntivirusGolden.lnk
%USERPROFILE%\StartMenu\AntivirusGolden 3.3.lnk
%USERPROFILE%\StartMenu\Programs\AntivirusGolden\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusGolden 3.3.lnk



Version 2.84 (September 07, 2006)


Update: Generic Renos Fix 1.6

%SYSTEM%\ismini.exe

O3 - Toolbar: Protection Bar - {fe2d25c1-c1db-4b5e-9390-af1cb5302f32} - C:\Program Files\PCODEC\iesplugin.dll
O3 - Toolbar: Protection Bar - {fe2d25c1-c1db-4b5e-9390-af1cb5302f32} - C:\Program Files\Media-Codec\iesplugin.dll
O3 - Toolbar: Protection Bar - {fe2d25c1-c1db-4b5e-9390-af1cb5302f32} - C:\Program Files\X Password Manager\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{fe2d25c1-c1db-4b5e-9390-af1cb5302f32}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe2d25c1-c1db-4b5e-9390-af1cb5302f32}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{fe2d25c1-c1db-4b5e-9390-af1cb5302f32}"=-

%SYSTEM%\gtpbx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fa55359-7223-410f-bc82-efb3e3ded07f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7fa55359-7223-410f-bc82-efb3e3ded07f}"="died"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"died"="{7fa55359-7223-410f-bc82-efb3e3ded07f}"

%SYSTEM%\duxzj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6570b782-1a41-4053-b2c9-12c7fcf0d84d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6570b782-1a41-4053-b2c9-12c7fcf0d84d}"="imputable"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"imputable"="{6570b782-1a41-4053-b2c9-12c7fcf0d84d}"

%USERPROFILE%\Local Settings\Application Data\AntispywareSoldier\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antispyware Soldier.lnk
%USERPROFILE%\StartMenu\Programs\Startup\antispysoldier.lnk
%ALLUSERPROFILE%\StartMenu\Programs\Antispyware Soldier\
%USERPROFILE%\Desktop\Antispyware Soldier.lnk
%PROGRAMFILES%\Antispyware Soldier\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antispyware Soldier_is1]
[-HKEY_CURRENT_USER\Software\ADV] (Already removed with SpywareSheriff)

%USERPROFILE%\StartMenu\Programs\HQ Codec\
%PROGRAMFILES%\HQ Codec\
[-HKEY_CURRENT_USER\Software\HQ Codec]
[-HKEY_CURRENT_USER\Software\HQCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HQCodec]



Version 2.83 (September 01, 2006)


Update: GenericRenosFix.exe V1.5

%SYSTEM%\eowygj.dll
[-HKEY_CLASSES_ROOT\CLSID\{e944d14a-03aa-43e3-9d0e-4f50c4d1b005}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e944d14a-03aa-43e3-9d0e-4f50c4d1b005}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e944d14a-03aa-43e3-9d0e-4f50c4d1b005}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gorgonian"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VSEnchancer.Chl]

%SYSTEM%\pigglett.exe
%SYSTEM%\popspig
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\]
"pigglett"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pigglett"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"pigglett"=-

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusBurst 6.1.lnk
%STARTMENU%\VirusBurst 6.1.lnk
%STARTMENU%\Programs\VirusBurst\
%DESKTOP%\VirusBurst.lnk
%PROGRAMFILES%\VirusBurst\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCFB2B33-F4DB-B63D-ABDC-C7384ED93B34}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05DDEB15-33E0-4DE3-B7CD-84E2E011D889}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B386DB3-239C-41D6-85CB-CA728F31F3FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E94C834-9EFA-4C46-B032-A185C69EBC53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34D2738B-701F-454A-9198-25924CF75E92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3863C215-13E6-4E29-9921-78CE0A6F272A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{420EE180-CE72-40AC-83CB-B55DCB68CCF1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{638C512D-C04A-4E06-A9A3-8127C4E5B4E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63CA0A34-071D-4780-A5BD-28F0CFC3E512}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{73467269-7B9F-4F66-B381-D914A7ACECEB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7DF33004-9121-4FD5-93B6-6376060D2D3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A7308DE2-D644-488D-80D5-071710F5B840}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ABA193DF-6C52-4D02-975A-94A85B32DC3C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AFB40450-78FE-4F01-BE69-A76A8C396304}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C793C7C5-E89F-48EC-83C9-06AC097E8CB9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAD91BD2-75E7-4E5F-A939-4ECC2D512918}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E120C137-922C-434C-8A02-2A8D27B3E2D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{728E63B0-5165-4E98-9C83-EF987EEB66C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusBurst.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusBurst]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusBurst]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusBurst"=-







Version 2.82 (August 29, 2006)


Update: swreg.exe v2.0.0.1 by SteelWerx
Added: dumphive.exe - Markus Stephany (http://www.mirkes.de)
Added: Export of [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]:"AppInit_DLLs" Value (Thanks Grinler)

%PROGRAMFILES%\PCODEC\
[-HKEY_CURRENT_USER\Software\PCODEC]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCODEC]

O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - C:\Program Files\PCODEC\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{202a961f-23ae-42b1-9505-ffe3c818d717}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{202a961f-23ae-42b1-9505-ffe3c818d717}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{202a961f-23ae-42b1-9505-ffe3c818d717}]

O3 - Toolbar: Protection Bar - {860c2f6b-ca82-4282-9187-beccbb66f0af} - C:\Program Files\PCODEC\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{860c2f6b-ca82-4282-9187-beccbb66f0af}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{860c2f6b-ca82-4282-9187-beccbb66f0af}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{860c2f6b-ca82-4282-9187-beccbb66f0af}"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{f7d40011-29bb-43eb-9c97-875ce89e9e36}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03]



Version 2.81 (August 06, 2006)


%SYSTEM%\mshtml32.tdb

O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\IntCodec\isaddon.dll
[HKEY_CLASSES_ROOT\CLSID\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}]

[-HKEY_CURRENT_USER\Software\X Password Manager]
%desktop%\x password manager.lnk

[-HKEY_CURRENT_USER\Software\Safety Bar]

C:\Documents and Settings\All Users\Start Menu\Online Security Guide.url
C:\Documents and Settings\All Users\Start Menu\Security Troubleshooting.url



Version 2.80 (August 05, 2006)


%WINDOWS%\bg_bg.gif
%WINDOWS%\big_red_x.gif
%WINDOWS%\buy_now.gif
%WINDOWS%\click_for_free_scan.gif
%WINDOWS%\close_ico.gif
%WINDOWS%\download.gif
%WINDOWS%\download_product.gif
%WINDOWS%\free_scan_red_btn.gif
%WINDOWS%\icon_warning_big.gif
%WINDOWS%\infected_top_bg.gif
%WINDOWS%\logo.gif
%WINDOWS%\navibar_bg.gif
%WINDOWS%\navibar_corner_left.gif
%WINDOWS%\navibar_corner_right.gif
%WINDOWS%\product_box.gif
%WINDOWS%\red_warning_ico.gif
%WINDOWS%\remove_spyware_header.gif
%WINDOWS%\safe_and_trusted.gif
%WINDOWS%\spyware_detected.gif
%WINDOWS%\System32fab.exe
%WINDOWS%\yellow_warning_ico.gif
%SYSTEM%\officescan.exe
%SYSTEM%\smaexp32.dll
%SYSTEM%\smartdrv.exe
%SYSTEM%\winblsrv.dll

%SYSTEM%\office_pnl.dll
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\System32\office_pnl.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53455DB-5527-4041-AC41-F86E6947AA47}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{900FBC20-6AEE-4E05-ABA9-AC46E309C029}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8B076501-1D1B-4B26-9492-FDB8EEE00D7F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\office_pnl.office_panel\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B53455DB-5527-4041-AC41-F86E6947AA47}



Version 2.79 (August 02, 2006)


%PROGRAMFILES%\X Password Manager\
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\X Password Manager]

%PROGRAMFILES%\Safety Bar\
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Safety Bar]

O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\Safety Bar.dll
[-HKEY_CLASSES_ROOT\CLSID\{052b12f7-86fa-4921-8482-26c42316b522}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{052b12f7-86fa-4921-8482-26c42316b522}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{052b12f7-86fa-4921-8482-26c42316b522}"=-

%SYSTEM%\fhmfes.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"hinnible"="{59080fb1-a43e-4059-a155-18b1eac7352c}"
[HKEY_CLASSES_ROOT\CLSID\{59080fb1-a43e-4059-a155-18b1eac7352c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59080fb1-a43e-4059-a155-18b1eac7352c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hinnible"="{59080fb1-a43e-4059-a155-18b1eac7352c}"



Version 2.78 (August 01, 2006)


O3 - Toolbar: Protection Bar - {a2595f37-48d0-46a1-9b51-478591a97764} - C:\Program Files\IntCodec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{a2595f37-48d0-46a1-9b51-478591a97764}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2595f37-48d0-46a1-9b51-478591a97764}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{a2595f37-48d0-46a1-9b51-478591a97764}"=-

O3 - Toolbar: Protection Bar - {d1ac752e-883f-4ed8-8828-b618c3a72152} - C:\Program Files\Media-Codec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{d1ac752e-883f-4ed8-8828-b618c3a72152}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d1ac752e-883f-4ed8-8828-b618c3a72152}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{d1ac752e-883f-4ed8-8828-b618c3a72152}"=-

%SYSTEM%\vwlummc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"hubbsi"="{7b1eeccd-0a6d-4ad5-8ac1-4af5722b3885}"
[HKEY_CLASSES_ROOT\CLSID\{7b1eeccd-0a6d-4ad5-8ac1-4af5722b3885}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b1eeccd-0a6d-4ad5-8ac1-4af5722b3885}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hubbsi"="{7b1eeccd-0a6d-4ad5-8ac1-4af5722b3885}"



Version 2.77 (August 01, 2006)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodec.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Media-Codec.Chl]

%SYSTEM%\viruxz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"bestreak"="{874443fe-aa33-4ebf-a6ac-73208787e62d}"
[HKEY_CLASSES_ROOT\CLSID\{874443fe-aa33-4ebf-a6ac-73208787e62d}]
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{874443fe-aa33-4ebf-a6ac-73208787e62d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bestreak"="{874443fe-aa33-4ebf-a6ac-73208787e62d}"

%SYSTEM%\urroxtl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"
[HKEY_CLASSES_ROOT\CLSID\{03413bf7-e34c-445b-bfc0-a2b127255871}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03413bf7-e34c-445b-bfc0-a2b127255871}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"



Version 2.76 (July 27, 2006)


%SYSTEM%\components\flx???.dll

[-HKEY_CURRENT_USER\Software\Media-Codec]

%PROGRAMFILES%\eMedia Codec\
[-HKEY_CURRENT_USER\Software\eMedia Codec]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\eMedia Codec]

%PROGRAMFILES%\IntCodec\
[-HKEY_CURRENT_USER\Software\IntCodec]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IntCodec]

%PROGRAMFILES%\PornMag Pass\
[-HKEY_CURRENT_USER\Software\PornMag Pass]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PornMag Pass]

%PROGRAMFILES%\ZipCodec\
[-HKEY_CURRENT_USER\Software\ZipCodec]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZipCodec]



Version 2.75 (July 24, 2006)


%DESKTOP%\Online Shopping.url
%DESKTOP%\Remove Adware.url
%DESKTOP%\Sex Personals.url
%DESKTOP%\Video Slots.url
%WINDOWS%\ads.js
%WINDOWS%\local.html
%WINDOWS%\mxd.exe
%WINDOWS%\onlineshopping.ico
%WINDOWS%\removeadware.ico
%WINDOWS%\sexpersonals.ico
%WINDOWS%\tctool.exe
%WINDOWS%\url.exe
%WINDOWS%\videoslots.ico

%TEMP%\_uninst35.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trust Cleaner Promo]

%WINDOWS%\inetloader.dll
O2 - BHO: WeeklyExecuter Class - {590FFB84-6A29-4797-9C0E-B15DF2C4CDCB} - C:\WINDOWS\inetloader.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{590FFB84-6A29-4797-9C0E-B15DF2C4CDCB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{81CDDAE8-3B92-4F0D-86C1-8DD5DB6A8471}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EFA1EC0F-8359-41B7-A178-7DD6805A0C79}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InetLoader.WeeklyExecuter]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InetLoader.WeeklyExecuter.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{590FFB84-6A29-4797-9C0E-B15DF2C4CDCB}]

%WINDOWS%\trustinbar.exe
%PROGRAMFILES%\TrustIn Bar\
O2 - BHO: TrustIn Bar Activator Class - {da7ff3f8-08be-4cac-bc00-94d91c6ae7f4} - C:\Program Files\trustin bar\trustin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TrustIn.activator]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TrustIn.activator.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4}]

O3 - Toolbar: TrustIn Bar - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - C:\Program Files\trustin bar\trustin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a19ef336-01d4-48e6-926a-fe7e1c747aed}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\TrustIn Bar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TrustIn.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TrustIn.StockBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustIn Bar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{a19ef336-01d4-48e6-926a-fe7e1c747aed}"=-

%WINDOWS%\tse.exe
%WINDOWS%\se_spoof.dll
O2 - BHO: SpoofBHO Class - {07A78AEA-4A54-4967-9A60-4B68592D30C7} - C:\WINDOWS\se_spoof.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07A78AEA-4A54-4967-9A60-4B68592D30C7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8C88AAE2-A341-4DE8-B064-062194307E5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{506146FD-9499-49A8-AEDE-692C173B2AA4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Se_spoof.SpoofBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Se_spoof.SpoofBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07A78AEA-4A54-4967-9A60-4B68592D30C7}]

O2 - BHO: ChangerBHO Class - {0D4C7057-EAD2-44C6-AD18-9092905F28F1} - C:\WINDOWS\system32\.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D4C7057-EAD2-44C6-AD18-9092905F28F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChangerBHO.ChangerBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChangerBHO.ChangerBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60D3A642-0B03-46AD-B8B0-8D45989A0055}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FEBB9141-2FF9-4FC8-BA91-1CE79DDE25CF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D4C7057-EAD2-44C6-AD18-9092905F28F1}]

%WINDOWS%\ticads.exe
%PROGRAMFILES%\TrustIn Contextual\
O2 - BHO: ContextualAds Class - {FE6C16C4-16AD-47B6-B250-26AD1829E49A} - C:\Program Files\TrustIn Contextual\trustincontext.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE6C16C4-16AD-47B6-B250-26AD1829E49A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TrustInContext.ContextualAds]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TrustInContext.ContextualAds.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C28EB22A-6966-4E4B-8592-E84C28D38402}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B1C54189-72F0-4353-987B-18FA221BEF09}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE6C16C4-16AD-47B6-B250-26AD1829E49A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Contextual Ads]

%WINDOWS%\tpopup.exe
%PROGRAMFILES%\TrustIn Popups
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TrustIn Popups"=-
[-HKEY_CURRENT_USER\Software\TrustIn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustIn Popups]
[-HKEY_LOCAL_MACHINE\SOFTWARE\TrustIn Popups]

%SYSTEM%\977efcdb.exe
%USERPROFILE%\Local Settings\Application Data\977efcdb.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"977efcdb.exe"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"977efcdb.exe"=-



Version 2.74 (July 19, 2006)


%SYSTEM%\components\flx?.dll
%SYSTEM%\components\flx??.dll

O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINDOWS\system32\hp100.tmp
[HKEY_CLASSES_ROOT\CLSID\{f7d40011-29bb-43eb-9c97-875ce89e9e36}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f7d40011-29bb-43eb-9c97-875ce89e9e36}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f7d40011-29bb-43eb-9c97-875ce89e9e36}]



Version 2.73 (July 17, 2006)


%PROGRAMFILES%\Media-Codec\

[HKEY_CURRENT_USER\Software\Internet Security]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Media-Codec]

O2 - BHO: (no name) - {5753791b-f607-48ca-814e-91c14d081f9e} - C:\Program Files\Media-Codec\isaddon.dll
[HKEY_CLASSES_ROOT\CLSID\{5753791b-f607-48ca-814e-91c14d081f9e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5753791b-f607-48ca-814e-91c14d081f9e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5753791b-f607-48ca-814e-91c14d081f9e}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"homepage.monitor.exe" = "C:\Program Files\Media-Codec\isamonitor.exe"
"pmsngr.exe" = "C:\Program Files\Media-Codec\pmsngr.exe"



Version 2.72 (July 16, 2006)


%PROGRAMFILES%\Malware-Wipe\
%DESKTOP%\Malware-Wipe.lnk
%STARTMENU%\Malware-Wipe 4.2.lnk
%STARTMENU%\Programs\Malware-Wipe\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware-Wipe 4.2.lnk

[HKEY_LOCAL_MACHINE\SOFTWARE\Malware-Wipe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (same as MalwareWipe 4.1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (same as MalwareWipe 4.1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9DFD0A51-6176-5770-217C-A5BCD7E6F3E2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{028800B5-3050-4A25-9D4C-1D765EF44598}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A8CD4A5-F54F-4EB6-9507-D32E4A8328C5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23F5ED0F-B621-408A-A857-B0FC38CCD6F4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C2E34BB-2F46-4B74-9EB4-F90B378E5E51}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49B0A793-F7D0-47F1-9183-16F6CDF161CB}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4BC6606C-7DCA-487A-89AC-5A1FDE51E721}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5416CDA8-A459-491F-8BC3-32AAC8899F26}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5A3E47AB-3FD1-4B5A-9296-BD3FC395B2D2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70FD26ED-6C79-4D3C-8B8B-0D23E9E8135B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7DAB1006-335A-4608-A596-218BB1893180}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA4947D5-1DB9-4CD2-98A5-2746C3776285}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B78BA1C4-A46A-4A69-88FD-27D8F6912E84}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB68F4C2-01ED-48A0-A94B-C78237B73387}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8A82314-6634-4C62-9663-9B943C08DF6C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB122CE1-2604-4570-9113-0536B0B99373}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB9A7A3B-2452-4A42-AE48-B197DEEBBDF8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FC33C950-7B73-4882-AAB2-0D4611796A27}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Malware-Wipe.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware-Wipe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malware-Wipe"="C:\Program Files\Malware-Wipe\Malware-Wipe.exe /h"

O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\System32\ixt0.dll
[HKEY_CLASSES_ROOT\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{873eb32d-ae1a-4183-89bd-45a77f761be4}]

%SYSTEM%\onofub.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"contraposition"="{3dab4d3e-1d45-406e-9cda-25227a7a2633}"
[HKEY_CLASSES_ROOT\CLSID\{3dab4d3e-1d45-406e-9cda-25227a7a2633}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dab4d3e-1d45-406e-9cda-25227a7a2633}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"contraposition"="{3dab4d3e-1d45-406e-9cda-25227a7a2633}"

%SYSTEM%\fjdcy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"chrysenic"="{3bb84870-e757-4fb1-a195-e2f7d3d95e40}"
[HKEY_CLASSES_ROOT\CLSID\{3bb84870-e757-4fb1-a195-e2f7d3d95e40}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3bb84870-e757-4fb1-a195-e2f7d3d95e40}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"chrysenic"="{3bb84870-e757-4fb1-a195-e2f7d3d95e40}"



Version 2.71 (July 12, 2006)


Generic Renos Fix v1.4 (new signature added)



Version 2.70 (July 12, 2006)


%SYSTEM%\mzoeut.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"cholecyst"="{ee2975b6-e8d5-405e-8448-8fe9590f6cfb}"
[HKEY_CLASSES_ROOT\CLSID\{ee2975b6-e8d5-405e-8448-8fe9590f6cfb}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee2975b6-e8d5-405e-8448-8fe9590f6cfb}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"cholecyst"="{ee2975b6-e8d5-405e-8448-8fe9590f6cfb}"

%SYSTEM%\pmnqguh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"
[HKEY_CLASSES_ROOT\CLSID\{93ac7c30-3878-4eaa-9420-7977285df5b1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93ac7c30-3878-4eaa-9420-7977285df5b1}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"

%SYSTEM%\yephk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"coursings"="{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}"
[HKEY_CLASSES_ROOT\CLSID\{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"coursings"="{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}"



Version 2.69 (July 10, 2006)


%SYSTEM%\ipztub.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"buys"="{e51e3ade-ddc4-45d9-9a21-36cf20ea9306}"
[HKEY_CLASSES_ROOT\CLSID\{e51e3ade-ddc4-45d9-9a21-36cf20ea9306}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e51e3ade-ddc4-45d9-9a21-36cf20ea9306}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"buys"="{e51e3ade-ddc4-45d9-9a21-36cf20ea9306}"

%SYSTEM%\posem.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{aeabe83d-672b-4717-9154-45bd6283c610}"="aporocactus"
[HKEY_CLASSES_ROOT\CLSID\{aeabe83d-672b-4717-9154-45bd6283c610}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{aeabe83d-672b-4717-9154-45bd6283c610}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{96E6B1C3-B5D0-89CC-4909-92D85A48B1A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0EBCA7C4-AA97-4B47-99D7-4932A73E9198}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16640BA0-193C-4BD5-882B-F92D6EF82156}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A041B9C-44AC-47FF-9399-CB8AEEF1CFE8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DFFBEAB-DB11-4602-A3E8-0454ED3F928B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{57DD6CFE-ABDB-46C2-92EB-316A5F499167}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{690D2910-BFD6-47D3-A96C-13E6BA2935E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8407F578-6FA7-446A-8852-53E6A147472E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85A126D1-2706-443D-9979-8841A1C5B482}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B11E589E-9A82-40EF-9777-8E13553F83D4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2E39865-E9E9-462F-87CB-9A09CEB4795F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E12E00DE-9BE2-486C-A9F1-19730F93807E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBDD9FB9-3A6C-4DA2-B0A9-D117528D4040}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED33F056-D246-4FF2-8D2A-D9F3938753BF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EFC68768-18B9-4930-9643-F6DD7AA60A71}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5EC0F1E-A3EB-49EA-BD87-989899B6E1C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEB6CDEC-70F6-4D2B-BCA4-1AB3BCDCC513}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A48995B0-2BB5-4246-B0EA-55B2FFCF9129}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyHeal.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyHeal]
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyHeal]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyHeal"=-

%ProgramFiles%\SpyHeal\
%DESKTOP%\SpyHeal.lnk
%STARTMENU%\SpyHeal 2.1.lnk
%STARTMENU%\Programs\SpyHeal\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyHeal 2.1.lnk



Version 2.68 (July 06, 2006)


Generic Renos Fix v1.3 (ShellServiceObjectDelayLoad keys scanner added)

%SYSTEM%\zlara.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"furnariidae"="{89e4aaba-3b21-49b3-b922-8ca35193c68e}"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"furnariidae"="{89e4aaba-3b21-49b3-b922-8ca35193c68e}"
[HKEY_CLASSES_ROOT\CLSID\{89e4aaba-3b21-49b3-b922-8ca35193c68e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89e4aaba-3b21-49b3-b922-8ca35193c68e}]

%SYSTEM%\vpxnk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"altmannsberger"="{210b4043-35ca-4aa0-8796-191f9663dfb3}"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"altmannsberger"="{210b4043-35ca-4aa0-8796-191f9663dfb3}"
[HKEY_CLASSES_ROOT\CLSID\{210b4043-35ca-4aa0-8796-191f9663dfb3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{210b4043-35ca-4aa0-8796-191f9663dfb3}]

%SYSTEM%\jevtxpg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"fairydom"="{5839511e-ec1b-4f91-ace3-fb88e52f5239}"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"fairydom"="{5839511e-ec1b-4f91-ace3-fb88e52f5239}"
[HKEY_CLASSES_ROOT\CLSID\{5839511e-ec1b-4f91-ace3-fb88e52f5239}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839511e-ec1b-4f91-ace3-fb88e52f5239}]



Version 2.67 (July 03, 2006)


%DESKTOP%\SpyQuake2.com.lnk
%STARTMENU%\SpyQuake2.com 2.3.lnk
%STARTMENU%\Programs\SpyQuake2.com\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyQuake2.com 2.3.lnk
%PROGRAMFILES%\SpyQuake2.com\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B55C4E3-C179-BA0B-B4FD-F2DB862D6202}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2DD8D482-8F1C-4180-AA8E-9D5819E5F2EA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{411F83B1-A0EC-4155-AF99-0137F5EFB270}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E3645AF-7A81-4F83-9B8C-1E4F930D873F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61032A65-2371-4C89-B5BB-DF73090FB5EA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66189AF2-7726-46E8-8628-0F95AB854792}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7A2F6251-6C99-4DA5-9827-954EB45DCB82}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82C6C396-DD7B-4CE5-B668-C0087D1F3A1F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{853E0D78-F4C2-47CB-A3F5-A774DA60DFCD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94786C47-EB3F-4BD5-A66B-0D49E2C90541}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9989A9BC-9828-467E-AF06-E3B279E6E97B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B2B3702A-5425-489E-A3AF-EDCCAFEBA019}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C1C56112-2B2E-4D3C-8CFC-7E10C77FACEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D01D4AAB-22C5-427F-A941-C4B65A3D8A23}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DDB0D689-FAE0-4165-9F7C-877602F9DD66}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E5AD5BD5-C710-45E0-ABD3-E770FE85DAE8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB5CA3AF-26C1-467B-9A55-2820E0451AAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5E05EA9F-1EA7-4D0B-A09B-D5E29EC758B9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Spy-Quake2.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyQuake2.com]
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyQuake2.com]

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyQuake2.com"=-



Version 2.66 (July 01, 2006)


%SYSTEM%\bpvcou.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{23f9d371-0bd6-41ab-a00b-a1f9342d6390}"="blasengeschwulste"
[HKEY_CLASSES_ROOT\CLSID\{23f9d371-0bd6-41ab-a00b-a1f9342d6390}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{23f9d371-0bd6-41ab-a00b-a1f9342d6390}]

O2 - BHO: adobepnl.ADOBE_PANEL - {A40D9D65-5C09-421A-AFF8-2160D7ABD4E7} - C:\WINDOWS\System32\adobepnl.dll
%SYSTEM%\ld???.tmp
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40D9D65-5C09-421A-AFF8-2160D7ABD4E7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A40D9D65-5C09-421A-AFF8-2160D7ABD4E7}]

%HOMEDRIVE%\dfndr?_?.exe
%HOMEDRIVE%\kybrd?_?.exe
%HOMEDRIVE%\nwnm?_?.exe



Version 2.65 (June 24, 2006)


%HOMEDRIVE%\dfndr.exe
%HOMEDRIVE%\dfndra.exe
%HOMEDRIVE%\kybrd.exe
%HOMEDRIVE%\nwnm.exe
%HOMEDRIVE%\dfndra_?.exe
%HOMEDRIVE%\kybrd_?.exe
%HOMEDRIVE%\nwnm_?.exe
%HOMEDRIVE%\drsmartload?.exe
%HOMEDRIVE%\drsmartload??.exe
%HOMEDRIVE%\drsmartload???.exe
%HOMEDRIVE%\drsmartload????.exe
%HOMEDRIVE%\MTE3NDI6ODoxNg.exe
%WINDOWS%\drsmartload2.dat
%WINDOWS%\keyboard1.dat
%WINDOWS%\newname.dat

%SYSTEM%\kkqfb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ccf982af-f3aa-48c4-97c4-ecdea4bd3fc3}"="husked"
[HKEY_CLASSES_ROOT\CLSID\{ccf982af-f3aa-48c4-97c4-ecdea4bd3fc3}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{ccf982af-f3aa-48c4-97c4-ecdea4bd3fc3}]

O2 - BHO: Nothing - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp???.tmp
[HKEY_CLASSES_ROOT\CLSID\{5f4c3d09-b3b9-4f88-aa82-31332fee1c08}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f4c3d09-b3b9-4f88-aa82-31332fee1c08}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5f4c3d09-b3b9-4f88-aa82-31332fee1c08}]



Version 2.64 (June 22, 2006)

%SYSTEM%\ixt?.dll
%SYSTEM%\ixt??.dll
%SYSTEM%\ishost.exe
%SYSTEM%\ismon.exe
%SYSTEM%\isnotify.exe
%SYSTEM%\issearch.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"ishost.exe"=-
"issearch.exe"=-

%SYSTEM%\tnvocyn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0ffdaffc-d80d-47bf-b9b0-895ea240f4de}"="adelges"
[HKEY_CLASSES_ROOT\CLSID\{0ffdaffc-d80d-47bf-b9b0-895ea240f4de}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0ffdaffc-d80d-47bf-b9b0-895ea240f4de}]



Version 2.63 (June 20, 2006)


O2 - BHO: (no name) - {7fcf04b6-6354-47ef-b45e-a48268e92757} - C:\WINDOWS\System32\ixt1.dll
%SYSTEM%\ixt0.dll
%SYSTEM%\ixt1.dll
HKEY_CLASSES_ROOT\CLSID\{7fcf04b6-6354-47ef-b45e-a48268e92757}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcf04b6-6354-47ef-b45e-a48268e92757}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7fcf04b6-6354-47ef-b45e-a48268e92757}

%SYSTEM%\viwpzla.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6af69c4d-420a-4c95-b34f-e4635f84f53b}"="forevouched"
[HKEY_CLASSES_ROOT\CLSID\{6af69c4d-420a-4c95-b34f-e4635f84f53b}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{6af69c4d-420a-4c95-b34f-e4635f84f53b}]

%SYSTEM%\guxxa.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{af3fd9a8-1287-4159-9212-9a5b4494af70}"="ecosystems"
[HKEY_CLASSES_ROOT\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}]

%SYSTEM%\hvcycg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7916f057-223f-4612-ac84-e882cbe043d4}"="bals"
[HKEY_CLASSES_ROOT\CLSID\{7916f057-223f-4612-ac84-e882cbe043d4}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{7916f057-223f-4612-ac84-e882cbe043d4}]



Version 2.62 (June 18, 2006)


%ALLUSERDESKTOP%\Security Troubleshooting.url

O2 - BHO: adobepnl.ADOBE_PANEL - {0F7E55FC-6D46-491C-922B-4EBC6636B561} - C:\WINDOWS\system32\adobepnl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F7E55FC-6D46-491C-922B-4EBC6636B561}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F7E55FC-6D46-491C-922B-4EBC6636B561}]

%SYSTEM%\xuefh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f85e05f5-667e-41b0-ab8a-147337a99e65}"="bloodthirst"
[HKEY_CLASSES_ROOT\CLSID\{f85e05f5-667e-41b0-ab8a-147337a99e65}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{f85e05f5-667e-41b0-ab8a-147337a99e65}]

%SYSTEM%\yvvdj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a2cd90b5-e5a2-4aac-a504-c964a6d499df}"="distractible"
[HKEY_CLASSES_ROOT\CLSID\{a2cd90b5-e5a2-4aac-a504-c964a6d499df}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{a2cd90b5-e5a2-4aac-a504-c964a6d499df}]

%SYSTEM%\oybgrql.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ed39ecef-902e-4ed1-8434-71e8db89e5ca}"="decorin"
[HKEY_CLASSES_ROOT\CLSID\{ed39ecef-902e-4ed1-8434-71e8db89e5ca}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{ed39ecef-902e-4ed1-8434-71e8db89e5ca}]



Version 2.61 (June 15, 2006)


O2 - BHO: adobepnl.ADOBE_PANEL - {C3E7E8D3-0B97-4FF3-B1BD-DAB4B04CD697} - C:\WINDOWS\system32\adobepnl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3E7E8D3-0B97-4FF3-B1BD-DAB4B04CD697}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C3E7E8D3-0B97-4FF3-B1BD-DAB4B04CD697}]

%SYSTEM%\lwpfwjb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{feac45db-84dc-4123-8b0d-4d9408fcf9ea}"="alymphia"
[HKEY_CLASSES_ROOT\CLSID\{feac45db-84dc-4123-8b0d-4d9408fcf9ea}\]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{feac45db-84dc-4123-8b0d-4d9408fcf9ea}]

%SYSTEM%\rmzdzx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9ae613a2-a13b-4379-8d0e-86a1a78476ec}"="corindon"
[HKEY_CLASSES_ROOT\CLSID\{9ae613a2-a13b-4379-8d0e-86a1a78476ec}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{9ae613a2-a13b-4379-8d0e-86a1a78476ec}]



Version 2.60 (June 13, 2006)


Generic Renos Fix 1.2 - New Signature added

%SYSTEM%\ekvrlfzz.exe

%SYSTEM%\erxbx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{315f73fc-a7b1-49e6-a3c4-cc00cf8a3fdb}"="fossilage"
[HKEY_CLASSES_ROOT\CLSID\{315f73fc-a7b1-49e6-a3c4-cc00cf8a3fdb}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{315f73fc-a7b1-49e6-a3c4-cc00cf8a3fdb}]

%SYSTEM%\ofcukiz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{05a91164-3c96-47d6-aa74-2c855791b2d0}"="incaged"
[HKEY_CLASSES_ROOT\CLSID\{05a91164-3c96-47d6-aa74-2c855791b2d0}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{05a91164-3c96-47d6-aa74-2c855791b2d0}]

%SYSTEM%\hzclqhc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8dc1f789-e073-4363-b40d-07376bc5ecc5}"="articulation"
[HKEY_CLASSES_ROOT\CLSID\{8dc1f789-e073-4363-b40d-07376bc5ecc5}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8dc1f789-e073-4363-b40d-07376bc5ecc5}]



Version 2.59 (June 12, 2006)


O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{77701e16-9bfe-4b63-a5b4-7bd156758a37}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77701e16-9bfe-4b63-a5b4-7bd156758a37}]

%WINDOWS%\about_spyware_bg.gif
%WINDOWS%\about_spyware_bottom.gif
%WINDOWS%\as.gif
%WINDOWS%\as_header.gif
%WINDOWS%\box_1.gif
%WINDOWS%\box_2.gif
%WINDOWS%\box_3.gif
%WINDOWS%\button_buynow.gif
%WINDOWS%\button_freescan.gif
%WINDOWS%\download_box.gif
%WINDOWS%\features.gif
%WINDOWS%\footer_back.gif
%WINDOWS%\footer_back.jpg
%WINDOWS%\header_1.gif
%WINDOWS%\header_2.gif
%WINDOWS%\header_3.gif
%WINDOWS%\header_4.gif
%WINDOWS%\main_back.gif
%WINDOWS%\rf.gif
%WINDOWS%\rf_header.gif
%WINDOWS%\scan_btn.gif
%WINDOWS%\security-center-bg.gif
%WINDOWS%\security-center-logo.gif
%WINDOWS%\security_center_caption.gif
%WINDOWS%\sep_hor.gif
%WINDOWS%\sep_vert.gif
%WINDOWS%\spacer.gif
%WINDOWS%\spacer.gif'
%WINDOWS%\spyware-detected.gif
%WINDOWS%\star_gray.gif
%WINDOWS%\star_gray_small.gif
%WINDOWS%\star_small.gif
%WINDOWS%\ts.gif
%WINDOWS%\ts_header.gif
%WINDOWS%\v.gif
%WINDOWS%\warning_icon.gif
%WINDOWS%\win_logo.gif
%WINDOWS%\x.gif
%SYSTEM%\qjrkvy.exe
%SYSTEM%\thlwin32.dll
%SYSTEM%\winflash.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2513A321-CB50-4C5F-91C5-80342AFACFB1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2513A321-CB50-4C5F-91C5-80342AFACFB1}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF17C9F7-3ABD-48BA-BCD3-3ADD3C1B65E5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B8CE2641-0F08-43A1-8F28-3AE65B395CB3}]



Version 2.58 (June 10, 2006)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TitanShield Antispyware_is1]
[HKEY_CURRENT_USER\Software\ADV] (Already removed with SpywareSheriff)

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\TitanShield Antispyware.lnk
%USERPROFILE%\Local Settings\Application Data\TitanShield\*.*
%STARTMENU%\Programs\TitanShield Antispyware\*.*
%STARTMENU%\Programmes\StartUp\titanshield.lnk
%DESKTOP%\TitanShield Antispyware.lnk
%PROGRAMFILES%\TitanShield Antispyware\*.*



Version 2.57 (June 10, 2006)


%SYSTEM%\users32.exe
%SYSTEM%\main.exe

O2 - BHO: adobepnl.ADOBE_PANEL - {5E8FA924-DEF0-4E71-8A82-A11CA0C1413B} - C:\WINDOWS\system32\adobepnl.dll
%SYSTEM%\adobepnl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E8FA924-DEF0-4E71-8A82-A11CA0C1413B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\adobepnl.ADOBE_PANEL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5E8FA924-DEF0-4E71-8A82-A11CA0C1413B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5FD68FB1-7D4C-4803-AB57-382E5CE342BC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C13F6A43-3C5A-429A-87D5-3BBF60099CF0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Srv32 spool service]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce\Srv32 spool service]

%SYSTEM%\dnefhw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3e4155b8-5a4a-4e95-83b2-ab032da9acbc}"="blooded"
[HKEY_CLASSES_ROOT\CLSID\{3e4155b8-5a4a-4e95-83b2-ab032da9acbc}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{3e4155b8-5a4a-4e95-83b2-ab032da9acbc}]

%SYSTEM%\asxbbx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5aaf6542-f4ba-4df4-873d-4902ecbe794c}"="antitragus"
[HKEY_CLASSES_ROOT\CLSID\{5aaf6542-f4ba-4df4-873d-4902ecbe794c}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{5aaf6542-f4ba-4df4-873d-4902ecbe794c}]



Version 2.56 (June 8, 2006)


%ALLUSERPROFILE%\Desktop\Online Security Guide.url

O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp???.tmp
[HKEY_CLASSES_ROOT\CLSID\{686a161d-5bd1-4999-8832-6393f41e564c}]
[HKLM\SOFTWARE\Classes\CLSID\{686a161d-5bd1-4999-8832-6393f41e564c}]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{686a161d-5bd1-4999-8832-6393f41e564c}]

%SYSTEM%\ornzq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9952355f-fefb-4764-bcd7-a993d03dd7e2}"="commencement"
[HKEY_CLASSES_ROOT\CLSID\{686a161d-5bd1-4999-8832-6393f41e564c}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{9952355f-fefb-4764-bcd7-a993d03dd7e2}]



Version 2.55 (June 5, 2006)


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Trust Cleaner"=-

%SYSTEM%\icima.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{55059d4f-a1ac-4837-ae07-4859101f598d}"="chromatodysopia"
[HKEY_CLASSES_ROOT\CLSID\{55059d4f-a1ac-4837-ae07-4859101f598d}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{55059d4f-a1ac-4837-ae07-4859101f598d}]

%SYSTEM%\acvgxw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5aaf6542-f4ba-4df4-873d-4902ecbe794c}"="acheweed"
[HKEY_CLASSES_ROOT\CLSID\{5aaf6542-f4ba-4df4-873d-4902ecbe794c}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{5aaf6542-f4ba-4df4-873d-4902ecbe794c}]

%SYSTEM%\ucbrrt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c3786a8d-6426-4c29-a23f-f36e47b31e0c}"="hillman"
[HKEY_CLASSES_ROOT\CLSID\{c3786a8d-6426-4c29-a23f-f36e47b31e0c}]
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{c3786a8d-6426-4c29-a23f-f36e47b31e0c}]



Version 2.54 (June 5, 2006)


%SYSTEM%\dcom_20.dll
%SYSTEM%\dcom_21.dll

%SYSTEM%\hp???.tmp
[HKEY_CLASSES_ROOT\CLSID\{6AB7158B-4BFF-4160-AD7D-4D622DF548CF}]
[HKLM\SOFTWARE\Classes\CLSID\{6AB7158B-4BFF-4160-AD7D-4D622DF548CF}]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6AB7158B-4BFF-4160-AD7D-4D622DF548CF}]

%SYSTEM%\vhywj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a0aa3e4b-31cb-4ea2-9049-22b7f5b65edb}"="fumarases"
[HKEY_CLASSES_ROOT\CLSID\{a0aa3e4b-31cb-4ea2-9049-22b7f5b65edb}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{a0aa3e4b-31cb-4ea2-9049-22b7f5b65edb}]

%SYSTEM%\ywbicim.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6c69e319-0d03-47da-997a-36586cbc53b3}"="fortread"
[-HKEY_CLASSES_ROOT\CLSID\{6c69e319-0d03-47da-997a-36586cbc53b3}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{6c69e319-0d03-47da-997a-36586cbc53b3}]

%SYSTEM%\yfysupa.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cbb430e6-5b1b-474a-9d7e-160d4fe74bea}"="feld"
[HKEY_CLASSES_ROOT\CLSID\{cbb430e6-5b1b-474a-9d7e-160d4fe74bea}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{cbb430e6-5b1b-474a-9d7e-160d4fe74bea}]



Version 2.53 (May 31, 2006)


%SYSTEM%\imfdfcj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e5b1e382-817e-4b74-8a96-ec78751e6acf}"="incatenate"
[HKEY_CLASSES_ROOT\CLSID\{e5b1e382-817e-4b74-8a96-ec78751e6acf}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{e5b1e382-817e-4b74-8a96-ec78751e6acf}]




Version 2.52 (May 30, 2006)


%SYSTEM%\yhbdupd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{aea3d2df-2b2c-4d7b-81a0-d975c6dc088e}"="alongshore"
[HKEY_CLASSES_ROOT\CLSID\{aea3d2df-2b2c-4d7b-81a0-d975c6dc088e}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{aea3d2df-2b2c-4d7b-81a0-d975c6dc088e}]

%SYSTEM%\hvnwm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{62eb0924-19d2-4226-b4b9-8ad1f70904c1}"="bronchovascular"
[HKEY_CLASSES_ROOT\CLSID\{62eb0924-19d2-4226-b4b9-8ad1f70904c1}]
[HKEY_CURRENT_USER\Software\Classes\CLSID\{62eb0924-19d2-4226-b4b9-8ad1f70904c1}]




Version 2.51 (May 30, 2006)


%TEMP%\wschtm35.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24E27EA9-FCF3-444F-BD80-20543BA5D946}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{24E27EA9-FCF3-444F-BD80-20543BA5D946}"="Trustworking System Class"

%DESKTOP%\Trust Cleaner.lnk
%USERPROFILE%\StartMenu\Programs\Trust Cleaner\
%PROGRAMFILES%\Trust Cleaner\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trust Cleaner]
[-HKEY_CURRENT_USER\Software\Trust Cleaner]




Version 2.50 (May 29, 2006)


%SYSTEM%\TheMatrixHasYou.exe
%SYSTEM%\0mcamcap.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"0mcamcap"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"0mcamcap"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"0mcamcap"=-

%SYSTEM%\bolnyz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f5947202-e9cb-4a72-88e7-22f2cbd2b124}"=-
[-HKEY_CLASSES_ROOT\CLSID\{f5947202-e9cb-4a72-88e7-22f2cbd2b124}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{f5947202-e9cb-4a72-88e7-22f2cbd2b124}]




Version 2.49b (May 27, 2006)


Use of %OS% variable for deeper test on Windows version.




Version 2.49 (May 27, 2006)


use of the cscript command to run GetPaths.vbs script rather than start

%SYSTEM%\ulztc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{24c60b9b-26b5-4201-9f7a-fb9219356ae9}"=-
[-HKEY_CLASSES_ROOT\CLSID\{24c60b9b-26b5-4201-9f7a-fb9219356ae9}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{24c60b9b-26b5-4201-9f7a-fb9219356ae9}]

%SYSTEM%\svchosts.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{A1D9D3F0-8C2A-9A1D-A376-2CACFB10AB72}"=-
[-HKEY_CLASSES_ROOT\CLSID\{A1D9D3F0-8C2A-9A1D-A376-2CACFB10AB72}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{A1D9D3F0-8C2A-9A1D-A376-2CACFB10AB72}]

[-HKEY_CURRENT_USER\Software\Classes\CLSID\{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{E802FFFF-8E58-4d2c-A435-8BEEFB10AB77}]




Version 2.48 (May 25, 2006)


%SYSTEM%\wfkduei.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0c7416f0-dd23-420f-97f5-aae352ea2bf1}"=-
[-HKEY_CLASSES_ROOT\CLSID\{0c7416f0-dd23-420f-97f5-aae352ea2bf1}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0c7416f0-dd23-420f-97f5-aae352ea2bf1}]

%SYSTEM%\oerucu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{336ec37f-54bf-4f13-8237-03f64fa591e7}"=-
[-HKEY_CLASSES_ROOT\CLSID\{336ec37f-54bf-4f13-8237-03f64fa591e7}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{336ec37f-54bf-4f13-8237-03f64fa591e7}]

%SYSTEM%\oqipt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5bc82bdb-bc03-4671-9a78-3ef2b68449de}"=-
[-HKEY_CLASSES_ROOT\CLSID\{5bc82bdb-bc03-4671-9a78-3ef2b68449de}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{5bc82bdb-bc03-4671-9a78-3ef2b68449de}]

%SYSTEM%\iqzv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{70fbd528-2d3c-4a00-9b8c-bbf441e534be}"=-
[-HKEY_CLASSES_ROOT\CLSID\{70fbd528-2d3c-4a00-9b8c-bbf441e534be}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{70fbd528-2d3c-4a00-9b8c-bbf441e534be}]

%SYSTEM%\sbnudh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{89aef01d-d237-49c7-84dc-4e1904c1fd31}"=-
[-HKEY_CLASSES_ROOT\CLSID\{89aef01d-d237-49c7-84dc-4e1904c1fd31}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{89aef01d-d237-49c7-84dc-4e1904c1fd31}]

%SYSTEM%\higjxe.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a0c51615-738a-4542-801a-5af61614e182}"=-
[-HKEY_CLASSES_ROOT\CLSID\{a0c51615-738a-4542-801a-5af61614e182}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{a0c51615-738a-4542-801a-5af61614e182}]

%SYSTEM%\htey.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a566f298-05a6-4b3d-b672-da7c27316430}"=-
[-HKEY_CLASSES_ROOT\CLSID\{a566f298-05a6-4b3d-b672-da7c27316430}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{a566f298-05a6-4b3d-b672-da7c27316430}]

%SYSTEM%\fyhhxw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e04408db-4812-4478-8d4d-e46edcffd3b6}"=-
[-HKEY_CLASSES_ROOT\CLSID\{e04408db-4812-4478-8d4d-e46edcffd3b6}]
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{e04408db-4812-4478-8d4d-e46edcffd3b6}]




Version 2.47 (May 24, 2006)


%SYSTEM%\dcom_18.dll
%SYSTEM%\dcom_19.dll
%STARTMENU%\SpyFalcon 3.1.lnk
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyFalcon 3.1.lnk

020 - Winlogon Notify: s_reg - %windir%\system32\notifysb.dll
%SYSTEM%\notifysb.dll
%WINDIR%\sss_main.ini
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\s_reg]

SpywareQuake.com 2.1
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05F169E6-B9E9-4655-8718-B3390D7F603A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1FCC2003-C5EB-4ED6-A31A-85A7028C5F06}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2557F3B3-37F3-45F5-B18A-985B0CD546F3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{30686499-4F72-46E0-B4C7-0DF36BE1002F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{36818356-5F51-47A0-BBCB-D2CF2578C009}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5616709E-BB23-4D9F-A9B5-2472C769F73B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6A539D25-03B6-46E8-BDD1-889632109485}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B781C5A-1A96-49C3-B1A0-F8400D46701A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{985F4791-DEF6-47B0-B4BC-94E49E03BDD2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9EDF97A9-DF39-4023-A73F-53146B61805A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A5E6FB36-865E-431B-AE48-6ED52E4A40E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B6711F-40C0-49A8-9C46-EA5906F7264D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B8EFA7B1-9614-4901-905D-698FC44926C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C7F06087-64B9-45C7-A74A-A2052B87ADF2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6909C99-4605-4E46-A2D3-EDE6D27D8539}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEA247FA-3E92-4962-BD8F-454CE943D8A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F863FC64-E607-453D-A69B-03911B71707E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Spyware-Quake.exe]




Version 2.46 (May 23, 2006)


Option 4 has been removed, Generic Renos Fix is now integrated in Option 2.
SharedTaskScheduler is exported in the log before and after Option 2.
Mode (Safe Mode / Normal Mode) is reported in the log.
Bug correction with Generic Renos Fix (all keys were not removed from registry when several infections were registered) Thanks to Marckie.



Version 2.45 (May 18, 2006)


%SYSTEM%\kernels8.exe (see kernels32.exe)
%SYSTEM%\dcom_16.dll (see dcom_15.dll)


%HOMEDRIVE%\defender??.exe
%WINDIR%\defender??.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"defender"=-


O2 - BHO: Nothing - {f79fd28e-36ee-4989-aa61-9dd8e30a82fa} - C:\WINDOWS\system32\hp????.tmp
[-HKEY_CLASSES_ROOT\CLSID\{f79fd28e-36ee-4989-aa61-9dd8e30a82fa}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f79fd28e-36ee-4989-aa61-9dd8e30a82fa}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{f79fd28e-36ee-4989-aa61-9dd8e30a82fa}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f79fd28e-36ee-4989-aa61-9dd8e30a82fa}]




Version 2.44 (May 14, 2006)


Generic Renos Fix Added


%SYSTEM%\win64.exe




Version 2.43 (May 11, 2006)


%SYSTEM%\winmuse.exe
O4 - HKLM\..\Run: [ZPoint] %SYSTEM%\winmuse.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\WMuse]


%SYSTEM%\winbrume.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{196B9CB5-4C83-46F7-9B06-9672ECD9D99B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
"{196B9CB5-4C83-46F7-9B06-9672ECD9D99B}"=-


%SYSTEM%\truetype.exe
O4 - HKLM\..\Run: [truetype] %SYSTEM%\truetype.exe
O4 - HKLM\..\RunServices: [truetype] %SYSTEM%\truetype.exe
O4 - HKCU\..\Run: [truetype] %SYSTEM%\truetype.exe


[-HKEY_LOCAL_MACHINE\SOFTWARE\ZEROSOFT]


%SYSTEM%\appmagr.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{64ba30a2-811a-4597-b0af-d551128be340}"=-

[-HKEY_CLASSES_ROOT\CLSID\{64ba30a2-811a-4597-b0af-d551128be340}]

[-HKEY_CURRENT_USER\Software\Classes\CLSID\{64ba30a2-811a-4597-b0af-d551128be340}]



Version 2.42 (May 10, 2006)


%SYSTEM%\autodisc32.dll

[-HKEY_CLASSES_ROOT\CLSID\{8e99f990-b75a-4568-b3c8-24cbc8cbbfc1}]

[-HKEY_CURRENT_USER\Software\Classes\CLSID\{8e99f990-b75a-4568-b3c8-24cbc8cbbfc1}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8e99f990-b75a-4568-b3c8-24cbc8cbbfc1}"=-



Version 2.41 (May 8, 2006)


%SYSTEM%\regperf.exe


%ALLUSERPROFILE%\Start Menu\Programs\Startup\.protected
%USERPROFILE%\Start Menu\Programs\Startup\.protected
%WINDOWS%\.protected
%SYSTEM%\drivers\etc\.protected


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktopChanges"=-
"NoActiveDesktop"=-




Version 2.40 (May 5, 2006)


%SYSTEM%\a.exe
%SYSTEM%\alxres.dll
%SYSTEM%\bridge.dll
%SYSTEM%\CWS_iestart.exe
%SYSTEM%\dailytoolbar.dll
%SYSTEM%\exuc32.tmp
%SYSTEM%\jao.dll
%SYSTEM%\mirarsearch_toolbar.exe
%SYSTEM%\questmod.dll
%SYSTEM%\reger.exe
%SYSTEM%\repigsp.exe
%SYSTEM%\shellgui32.dll
%SYSTEM%\susp.exe
%SYSTEM%\udpmod.dll
%SYSTEM%\winbl32.dll
%SYSTEM%\winsrv32.exe
%WINDOWS%\alexaie.dll
%WINDOWS%\alxie328.dll
%WINDOWS%\alxtb1.dll
%WINDOWS%\BTGrab.dll
%WINDOWS%\dlmax.dll
%WINDOWS%\Pynix.dll
%WINDOWS%\susp.exe
%WINDOWS%\ZServ.dll
%WINDOWS%\adware-sheriff-box.gif
%WINDOWS%\adware-sheriff-header.gif
%WINDOWS%\antispylab-logo.gif
%WINDOWS%\blue-bg.gif
%WINDOWS%\buy-now-btn.gif
%WINDOWS%\close-bar.gif
%WINDOWS%\corner-left.gif
%WINDOWS%\corner-right.gif
%WINDOWS%\facts.gif
%WINDOWS%\footer.gif
%WINDOWS%\free-scan-btn.gif
%WINDOWS%\h-line-gradient.gif
%WINDOWS%\header-bg.gif
%WINDOWS%\infected.gif
%WINDOWS%\info.gif
%WINDOWS%\no-icon.gif
%WINDOWS%\reg-freeze-box.gif
%WINDOWS%\reg-freeze-header.gif
%WINDOWS%\remove-spyware-btn.gif
%WINDOWS%\spyware-sheriff-header.gif
%WINDOWS%\spyware-sheriff-box.gif
%WINDOWS%\star.gif
%WINDOWS%\star-grey.gif
%WINDOWS%\true-stories.gif
%WINDOWS%\warning-bar-ico.gif
%WINDOWS%\win-sec-center-logo.gif
%WINDOWS%\windows-compatible.gif
%WINDOWS%\yes-icon.gif

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{951B3138-AE8E-4676-A05A-250A5F111631}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\DailyToolbar.DLL]
[-HKEY_LOCAL_MACHINE\Software\Classes\AppID\WStart.DLL]

[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{58F9B276-E1CC-458e-8159-21CBC021874B}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{60e2e76b-60e2e76b-60e2e76b-60e2e76b-60e2e76b}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{80bb7465-a638-43b5-9827-8e8fe38dfcc1}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8333C319-0669-4893-A418-F56D9249FCA6}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E52DEDBB-D168-4BDB-B229-C48160800E81}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F1FABE79-25FC-46de-8C5A-2C6DB9D64333}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BBB0424-E98E-4405-9A94-481854765C80}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0F3332B5-BC98-48AF-9FAC-05FEC94EBE73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{10195311-E434-47A9-ADBA-48839E3F7E4E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E60160F-0ED6-4DCC-B6B6-850CDE4FD217}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4FDBDBAD-FEFE-4C4C-9CC1-1181052AFB12}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A69107CC-BEC8-4A34-B474-211B0F46A764}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6A68CBD-6673-41B1-B997-3F83A25B45B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ABAFA0B4-F78D-42E5-8C31-1A441D01C1DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B71C7D9A-DA43-4E8B-BB98-1684AC2AF324}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B84995-8B92-46BF-94AA-FA2F3DD23B84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA77AD79-09CF-41FB-B171-CC856F9E737F}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{547AB549-4DD8-4ea0-B070-F6EA062148FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{c094876d-1b0e-46fa-b6a6-7ffc0f970c27}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB.BHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Bridge.brdg]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DailyToolbar.IEBand]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DailyToolbar.SysMgr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEToolbar.AffiliateCtl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jao.jao]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PopMenu.Menu]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Popup.HTMLEvent.]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Popup.PopupKiller]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\url_relpacer.URLResolver]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Alexa Internet]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Alexa Toolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\DailyToolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\NIX Solutions]
[-HKEY_LOCAL_MACHINE\SOFTWARE\RespondMiter]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Software\TPS108]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Transponder]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-59D4-4008-9058-080011001200}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-C1EC-0345-6EC2-4D0300000000}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-F09C-02B4-6EC2-AD0300000000}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ceff6cd-6f08-4e4d-bccd-ff7415288c3b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7b55bb05-0b4d-44fd-81a6-b136188f5deb}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8333c319-0669-4893-a418-f56d9249fca6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9c691a33-7dda-4c2f-be4c-c176083f35cf}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e52dedbb-d168-4bdb-b229-c48160800e81}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffd2825e-0785-40c5-9a41-518f53a8261f}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Transponder"=-
"Adware.Srv32"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Srv32 spool service"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Srv32 spool service"=-

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\IPCheck]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alexa Toolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bridge]

(%SYSTEM%\winapi32.dll)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.MyBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62E2E094-F989-48C6-B947-6E79DA2294F9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31F9B5A7-5B94-445D-922C-E97BF52F5FD7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{74AC67A5-CDB1-4FD2-A30B-47BD59FF28A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62E2E094-F989-48C6-B947-6E79DA2294F9}]


%SYSTEM%\reglogs.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{35a88e51-b53d-43e9-b8a7-75d4c31b4676}"=-

[-HKEY_CLASSES_ROOT\CLSID\{35a88e51-b53d-43e9-b8a7-75d4c31b4676}]

[-HKEY_CURRENT_USER\Software\Classes\CLSID\{35a88e51-b53d-43e9-b8a7-75d4c31b4676}]



Version 2.39 (May 3, 2006)


%userprofile%\Local Settings\Application Data\SpywareSheriff\*.*
%ProgramFiles%\SpywareSheriff\*.*
%Desktop%\SpywareSheriff.lnk
%AllUsersProfile%\StartMenu\Programs\SpywareSheriff\*.*
%userprofile%\StartMenu\Programs\D�marrage\spysheriff.lnk
%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareSheriff.lnk

[-HKEY_CURRENT_USER\Software\ADV]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareSheriff_is1]



%SYSTEM%\dvdcap.dll

[-HKEY_CLASSES_ROOT\CLSID\{1C3B31AE-FD16-D2CE-43FF-DC4CD5C1BC5E}]

[-HKEY_CURRENT_USER\Software\Classes\CLSID\{1C3B31AE-FD16-D2CE-43FF-DC4CD5C1BC5E}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
{1C3B31AE-FD16-D2CE-43FF-DC4CD5C1BC5E}=-




Version 2.38 (May 3, 2006)


Fraud Notice added


Corrections made for Japanese OS - Thanks Gunjyou & Mech.Mozilla !


Corrections on Win2K message: "cannot import cleanup.reg: Error accessing the registry":

[HKEY_CURRENT_USER\]
"ColorTable19"=-
"ColorTable20"=-



C:\Documents and Settings\user\Menu D�marrer\Programmes\PestTrap\*.*
C:\Documents and Settings\user\Bureau\PestTrap.lnk
C:\Program Files\PestTrap\*.*

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PestTrap]
[-HKEY_CURRENT_USER\Software\PestTrap]
[-HKEY_CURRENT_USER\Software\SNO2]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PestTrap"=-



%WINDIR%\pop06ap2.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pop06ap"=-






Version 2.37 (April 28, 2006)


%SYSTEM%\atmclk.exe



%DESKTOP%\MalwareWipe.lnk
%STARTMENU%\MalwareWipe 4.1.lnk
%STARTMENU%\Programs\MalwareWipe\*.*
C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWipe 4.1.lnk
%PROGRAMFILES%\MalwareWipe\*.*

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5C70510-5A01-B2A5-CF84-D6DC13859967}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B595E3D-27BE-4DA1-A278-CA4D904B5823}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D1E9B3D-5A4C-4C70-A9B4-5A19E0C625DC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A34546C-C437-460A-88AF-D4703A548EA9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D9FD47C-E0B5-4005-9ADE-552980D3761F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E5B0894-FE91-4063-BB41-D885C7691581}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{479B1AEA-4414-4E43-8CBF-94BFC7C69B56}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A2ECC12-46BA-4C52-9749-C0FAF38D507B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D6079CB-FD9E-46AF-A896-6E8582E52827}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{511A9BB1-917A-414A-88FD-3128E37032A1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8CBED98F-8DDD-4AF0-A9EA-C75E10C937BC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A44CAB15-6B7E-406B-9D9B-B1C1C6BA8CDB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A99AC77F-4DE5-4AA2-810A-35FAB5FC114B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B74B2B6C-9B8D-47D9-872F-E83D475AAF34}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE5ECF63-6065-4B92-8B7E-72B5042C2F25}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4BFBB89-4BC5-4D13-8D3A-75EDCC0CF50C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E86D0281-FA5A-4E36-B993-84FD87DA9DF1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{177E74D6-E1D1-4D15-9D36-85399BA00729}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWipe.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWipe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWipe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareWipe"=-





Version 2.36 (April 27, 2006)

Search SharedTaskScheduler v1.1.0.2
- IE7 SharedTaskScheduler White Listed


%SYSTEM%\dcomcfg.exe
%SYSTEM%\simpole.tlb
%SYSTEM%\stdole3.tlb

O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hp****.tmp

[-HKEY_CLASSES_ROOT\CLSID\{b0398eca-0bcd-4645-8261-5e9dc70248d0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B0398ECA-0BCD-4645-8261-5E9DC70248D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{b0398eca-0bcd-4645-8261-5e9dc70248d0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b0398eca-0bcd-4645-8261-5e9dc70248d0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"dcomcfg.exe"=-




Version 2.35 (April 26, 2006)

Search SharedTaskScheduler v1.1 (White List Trigger added)



%SYSTEM%\dlh9jkdq?.exe



%SYSTEM%\netfilt4.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"netfilt4"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"netfilt4"=-



%system%\twain32.dll

[-HKEY_CLASSES_ROOT\CLSID\{CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E}"=-



O2 - BHO: Nothing - {edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e} - C:\WINDOWS\system32\hp????.tmp
[-HKEY_CLASSES_ROOT\CLSID\{edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e}]



[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{008E3200-28EB-463b-9B58-75C23D80911A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CBD1CBA-E034-4287-9B49-5F2912E1D33B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18575620-E41D-4204-BF6F-964069D80F45}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B860BE9-5B96-4443-9714-6ACD89989D1E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5796859D-53C4-46C1-AD6F-2A3C4D4306EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{597892CA-A878-4A04-978F-DBA8DC2BB2FB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{673A88D4-C0E0-40D2-9B93-AE39D9A1675F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CC220DA-D962-4935-AD3A-21F7CA4962E3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9DD57F95-DA3A-4EDA-9475-27CCF366A4FD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B4D9C59B-A091-4D79-90CC-DD92F3BACF63}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B8F90F00-CF78-4431-A13F-58B979F7EE20}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CDEB1FD8-0917-40A2-B915-8FB9D7FDD75C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF277F5A-347E-40C2-BAF0-4F09D0607041}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5DE421A-4AA5-4FE3-AA43-7D2A87D6267F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD2D402A-DE41-47A6-AAC9-0D756776203E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2F430FD-3062-4808-B23F-4B322BFED93F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9B91E0C-305A-4DD2-9987-B3B0C254C6DE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EFD28371-A165-4873-A158-421D208FFE5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B4E17829-DACB-4320-9ABF-DCB382221FC2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyFalcon.PopupBlockerConnector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyFalcon.PopupBlockerConnector.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyFalcon]




Version 2.34 (April 23, 2006)



%system%\sivudro.dll

[-HKEY_CLASSES_ROOT\CLSID\{EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E}"=-



%userprofile%\Desktop\Spyware Soft Stop.lnk
%alluserprofile%\Start Menu\Programs\Spyware Soft Stop\
%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Spyware Soft Stop.lnk
%Program Files%\Spyware Soft Stop\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Soft Stop_is1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Software Soft Stop"=-



%WINDIR%\xpupdate.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows update loader"=-



%userprofile%\Desktop\BraveSentry.lnk
%userprofile%\Start Menu\Programs\BraveSentry\
%Program Files%\BraveSentry\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSentry]
[-HKEY_CURRENT_USER\Software\BraveSentry]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BraveSentry"=-







Version 2.33 (April 18, 2006)

Short paths (8.3) for desktop, start menu, favorites are retrieved from registry keys.




Version 2.32 (April 18, 2006)


%system%\xenadot.dll

[-HKEY_CLASSES_ROOT\CLSID\{CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A}"=-



Version 2.31 (April 15, 2006)


%system%\suprox.dll

[-HKEY_CLASSES_ROOT\CLSID\{AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E}"=-


%userprofile%\Bureau\SpywareQuake.com.lnk
%userprofile%\Menu D�marrer\SpywareQuake.com 2.1.lnk
%userprofile%\Menu D�marrer\Programmes\SpywareQuake.com\
%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareQuake.com 2.1.lnk
%Program Files%\SpywareQuake.com\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareQuake.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake.com]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
SpywareQuake.com=-




Version 2.30 (April 15, 2006)

Correction has been made on these 2 legit files:
%SYSTEM%\amcompat.tlb
%SYSTEM%\interf.tlb



O2 - BHO: Nothing - {8d83b16e-0de1-452b-ac52-96ec0b34aa4b} - C:\WINDOWS\system32\hp????.tmp
[-HKEY_CLASSES_ROOT\CLSID\{8d83b16e-0de1-452b-ac52-96ec0b34aa4b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8d83b16e-0de1-452b-ac52-96ec0b34aa4b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{8d83b16e-0de1-452b-ac52-96ec0b34aa4b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8d83b16e-0de1-452b-ac52-96ec0b34aa4b}]



[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22}]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{736B5468-BDAD-41BE-92D0-22AE2DDF7BCB}]




%SYSTEM%\lich.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
lich=-



%userprofile%\Start Menu\Programmes\SpyGuard
%userprofile%\desktop\SpyGuard.lnk
%ProgramFiles%\SpyGuard

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\The Spy Guard]

[-HKEY_CURRENT_USER\Software\TheSpyGuard]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"The Spy Guard"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"The Spy Guard Monitor"=-






-----

Version 2.29 (April 9, 2006)

%SYSTEM%\amcompat.tlb
%SYSTEM%\interf.tlb
%SYSTEM%\nscompat.tlb
%SYSTEM%\__delete_on_reboot__stickrep.dll



O2 - BHO: Nothing - {7a932ed2-1737-4ab8-b84d-c71779958551} - C:\WINDOWS\system32\hp????.tmp
HKEY_CLASSES_ROOT\CLSID\{7A932ED2-1737-4AB8-B84D-C71779958551}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A932ED2-1737-4AB8-B84D-C71779958551}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{7A932ED2-1737-4AB8-B84D-C71779958551}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A932ED2-1737-4AB8-B84D-C71779958551}



%SYSTEM%\taskdir.dll
%SYSTEM%\taskdir.exe
%SYSTEM%\taskdir~.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"taskdir"=-

[HKEY_CURRENT_USER]
ColorTable20=-
ColorTable19=-



Version 2.28 (April 4, 2006)

Restore Enhanced Security Configuration Zone map:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains


%HOMEDRIVE%\country.exe
%HOMEDRIVE%\exit
%HOMEDRIVE%\kl1.exe
%HOMEDRIVE%\ms1.exe
%HOMEDRIVE%\tool1.exe
%HOMEDRIVE%\tool2.exe
%HOMEDRIVE%\tool3.exe
%HOMEDRIVE%\tool4.exe
%HOMEDRIVE%\tool5.exe
%HOMEDRIVE%\toolbar.exe
%HOMEDRIVE%\uniq
%SYSTEM%\parad.raw.exe
%PROGRAMFILES%\secure32.html


%PROGRAMFILES%\paytime.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SysTray=-


%system32%\dcom_14.dll
%system32%\dcom_15.dll

[-HKEY_CLASSES_ROOT\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB8C34}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB8C34}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
{2C1CD3D7-86AC-4068-93BC-A02304BB8C34}=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
DCOM Server=-


%SYSTEM%\tetriz3.exe
%SYSTEM%\bin29a.log

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]
ATI_VER=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
tetriz3=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
tetriz3=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
tetriz3=-


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
nvchost=-

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Key=-


Version 2.27 (April 1, 2006)

Francais/English Version

%WINDIR%\keyboard.exe
%WINDIR%\keyboard?.exe
%WINDIR%\mousepad.exe
%WINDIR%\mousepad?.exe
%WINDIR%\newname.exe
%WINDIR%\newname?.exe


Version 2.26 (March 26, 2006)

%HOMEDRIVE%\newname?.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"newname"=-


%userprofile%\Startmen�\Programme\Autostart

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22}]


%system%\stickrep.dll

[-HKEY_CLASSES_ROOT\CLSID\{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"=-


%userprofile%\Bureau\SpywareQuake.lnk
%userprofile%\Menu D�marrer\SpywareQuake 2.0.lnk
%userprofile%\Menu D�marrer\Programmes\SpywareQuake\*.*
%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareQuake 2.0.lnk
%Program Files%\SpywareQuake\*.*

[-HKEY_CLASSES_ROOT\CLSID\{5B55C4E3-C179-BA0B-B4FD-F2DB862D6202}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B55C4E3-C179-BA0B-B4FD-F2DB862D6202}]
[-HKEY_CLASSES_ROOT\Interface\{189518DF-7EBA-4D31-A7E1-73B5BB60E8D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{189518DF-7EBA-4D31-A7E1-73B5BB60E8D5}]
[-HKEY_CLASSES_ROOT\Interface\{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}]
[-HKEY_CLASSES_ROOT\Interface\{43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB}]
[-HKEY_CLASSES_ROOT\Interface\{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}]
[-HKEY_CLASSES_ROOT\Interface\{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}]
[-HKEY_CLASSES_ROOT\Interface\{76D06077-D5D3-40CA-B32D-6A67A7FF3F06}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76D06077-D5D3-40CA-B32D-6A67A7FF3F06}]
[-HKEY_CLASSES_ROOT\Interface\{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}]
[-HKEY_CLASSES_ROOT\Interface\{9283DAC1-43F5-4580-BF86-841F22AF2335}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9283DAC1-43F5-4580-BF86-841F22AF2335}]
[-HKEY_CLASSES_ROOT\Interface\{AE90CAFC-09D4-47F0-9E11-CE621C424F08}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE90CAFC-09D4-47F0-9E11-CE621C424F08}]
[-HKEY_CLASSES_ROOT\Interface\{BA397E39-F67F-423F-BC6E-65939450093A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA397E39-F67F-423F-BC6E-65939450093A}]
[-HKEY_CLASSES_ROOT\Interface\{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}]
[-HKEY_CLASSES_ROOT\Interface\{C4EEDC19-992D-409A-B323-ED57D511AFA5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4EEDC19-992D-409A-B323-ED57D511AFA5}]
[-HKEY_CLASSES_ROOT\Interface\{DD90F677-D205-4F70-9014-659614AABCB2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD90F677-D205-4F70-9014-659614AABCB2}]
[-HKEY_CLASSES_ROOT\Interface\{E3DF91F3-F24F-441E-9001-D61F36024322}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DF91F3-F24F-441E-9001-D61F36024322}]
[-HKEY_CLASSES_ROOT\Interface\{F459EADB-5903-48D5-864C-2B7B46AB1424}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F459EADB-5903-48D5-864C-2B7B46AB1424}]
[-HKEY_CLASSES_ROOT\Interface\{FC4EDF66-0547-4F1A-AE96-7CFCAD711C90}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4EDF66-0547-4F1A-AE96-7CFCAD711C90}]
[-HKEY_CLASSES_ROOT\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareQuake.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareQuake]
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareQuake"=-


Version 2.25

C:\Documents and Settings\user\Bureau\AdwareSheriff.lnk
C:\Documents and Settings\All Users\Menu D�marrer\Programmes\AdwareSheriff\*.*
C:\Documents and Settings\user\Local Settings\Application Data\AdwareSheriff\*.*
C:\Documents and Settings\user\Menu D�marrer\Programmes\D�marrage\asheriff.lnk
C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\AdwareSheriff.lnk
C:\Program Files\AdwareSheriff\*.*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AdwareSheriff_is1
HKEY_CURRENT_USER\Software\ADV

HKEY_CURRENT_USER\Software\SNO2


Version 2.24

Ajout de restart.exe=SuperFast Shutdown (http://www.xp-smoker.com/freeware.html) pour forcer un redemarrage rapide.

%WINDOWS%\adsldpbj.dll
%WINDOWS%\gimmygames.dat
%WINDOWS%\muwq\*.*
%WINDOWS%\teller2.chk
%WINDOWS%\winsysban8.exe
%HOMEDRIVE%\mousepad1.exe
%HOMEDRIVE%\mousepad.exe
%HOMEDRIVE%\gimmysmileys1.exe
%HOMEDRIVE%\keyboard.exe
%HOMEDRIVE%\keyboard1.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"keyboard"=-
"mousepad"=-

O3 - Toolbar: SecurityToolbar - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - C:\Program Files\Security Toolbar\Security Toolbar.dll

%Program Files%\Security Toolbar\Security Toolbar.dll
%SYSTEM%\Security Toolbar.dll

[-HKEY_CLASSES_ROOT\CLSID\{736B5468-BDAD-41BE-92D0-22AE2DDF7BCB}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{736B5468-BDAD-41BE-92D0-22AE2DDF7BCB}=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{736B5468-BDAD-41BE-92D0-22AE2DDF7BCB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{736B5468-BDAD-41BE-92D0-22AE2DDF7BCB}=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Toolbar]

%WINDOWS%\sysvx_.exe
%SYSTEM%\comdlg64.dll
%SYSTEM%\sysvx.exe
%SYSTEM%\whitevx.lst
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sysvx"=-


Version 2.23

%WINDOWS%\azesearch.bmp
%WINDOWS%\drsmartload95a.exe
%WINDOWS%\kl1.exe
%WINDOWS%\loadadv728.exe
%SYSTEM%\dfrgsrv.exe
%SYSTEM%\dxole32.exe
%userprofile%\Favorites\Antivirus Test Online.url

%WINDOWS%\osaupd.exe
%WINDOWS%\wupdmgr.exe
[-HKEY_CLASSES_ROOT\Balloon.Application]
[-HKEY_CLASSES_ROOT\CLSID\{1CA7DBAF-B066-4554-977E-5CEBB7FA59C8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Balloon.Application]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CA7DBAF-B066-4554-977E-5CEBB7FA59C8}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"mquu"=-
"qofk"=-

%HOMEDRIVE%\gimmysmileys.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gimmysmileys"=-


Version 2.22

%system%\ginuerep.dll
[-HKEY_CLASSES_ROOT\CLSID\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}"=-


Version 2.21

%WINDOWS%\adw.htm
%WINDOWS%\back.gif
%WINDOWS%\bg.gif
%WINDOWS%\buy-btn.gif
%WINDOWS%\download-btn.gif
%WINDOWS%\temp.000.exe
%SYSTEM%\bu.exe
%SYSTEM%\intxt.exe
%SYSTEM%\mswinb32.dll
%SYSTEM%\mswinb32.exe
%SYSTEM%\mswinf32.exe
%SYSTEM%\mswinf32.dll
%SYSTEM%\mswinup32.dll
%SYSTEM%\mswinxml.dll
%SYSTEM%\shell386.exe
%SYSTEM%\winapi32.dll
%SYSTEM%\winlfl32.dll

%SYSTEM%\adsmart.exe
O4 - HKLM\..\Run: [Win32.Virus.Smart32]

%SYSTEM%\exa32.exe
O4 - HKLM\..\Run: [Win32.Exploit.A]

O2 - BHO: winapi32.MyBHO - {1CBC7F79-C21A-4468-8116-38E8AD875816} - C:\WINDOWS\System32\winapi32.dll
HKEY_CLASSES_ROOT\CLSID\{1CBC7F79-C21A-4468-8116-38E8AD875816}
HKEY_CLASSES_ROOT\Interface\{376C5E0D-E8DD-4161-B74B-37E6323E538E}
HKEY_CLASSES_ROOT\winapi32.MyBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CBC7F79-C21A-4468-8116-38E8AD875816}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{376C5E0D-E8DD-4161-B74B-37E6323E538E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.MyBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CBC7F79-C21A-4468-8116-38E8AD875816}

HKEY_CLASSES_ROOT\CLSID\{9F230924-E275-4FD2-BC99-5C30362332E3}
HKEY_CLASSES_ROOT\Interface\{D4D2958F-EDBE-430B-AB15-793E921C3A09}
HKEY_CLASSES_ROOT\winapi32.Intelinks
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F230924-E275-4FD2-BC99-5C30362332E3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4D2958F-EDBE-430B-AB15-793E921C3A09}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.Intelinks

HKEY_CLASSES_ROOT\CLSID\{4823B0A6-EAB4-4577-9792-C59231379CEA}
HKEY_CLASSES_ROOT\Interface\{50F91B80-0270-46CE-86B1-4C508F5CB280}
HKEY_CLASSES_ROOT\winapi32.MyBaner
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4823B0A6-EAB4-4577-9792-C59231379CEA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50F91B80-0270-46CE-86B1-4C508F5CB280}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.MyBaner

HKEY_CLASSES_ROOT\TypeLib\{7885264B-8B30-46EB-8361-ECA766800258}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7885264B-8B30-46EB-8361-ECA766800258}


Version 2.20

C:\Documents and Settings\user\Bureau\SpyFalcon.lnk
C:\Documents and Settings\user\Menu D�marrer\SpyFalcon 2.0.lnk
C:\Documents and Settings\user\Menu D�marrer\Programmes\SpyFalcon\
C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyFalcon 2.0.lnk
C:\Program Files\SpyFalcon\

O4 - HKLM\..\Run: [SpyFalcon] C:\Program Files\SpyFalcon\SpyFalcon.exe /h

HKEY_CLASSES_ROOT\CLSID\{330A77C2-C15A-43B5-055C-B4E35EAED279}
HKEY_CLASSES_ROOT\Interface\{001501E7-C970-4CB1-9740-E055BF3DDFD6}
HKEY_CLASSES_ROOT\Interface\{0FBBBC44-296D-4A2F-AF45-BE1EE387F569}
HKEY_CLASSES_ROOT\Interface\{163469FD-6009-48E2-AD8C-47BB2E0D88BE}
HKEY_CLASSES_ROOT\Interface\{1694E5C6-9E1F-4C3B-B79A-828C2FC40003}
HKEY_CLASSES_ROOT\Interface\{200BD3A6-A02B-4BAC-A364-A9D8017E3C4E}
HKEY_CLASSES_ROOT\Interface\{20C59F9F-33CB-4B1B-AFB6-B710DB845709}
HKEY_CLASSES_ROOT\Interface\{23D80835-4A3A-4572-9F5F-3F24A7A28AE5}
HKEY_CLASSES_ROOT\Interface\{255CDDA3-576B-44C9-B944-46EAC18D5D6F}
HKEY_CLASSES_ROOT\Interface\{3261F690-1CA4-4839-928B-F4F898B74EB7}
HKEY_CLASSES_ROOT\Interface\{37B9988B-1997-41F4-A832-DAE42CC3F7C2}
HKEY_CLASSES_ROOT\Interface\{5B861FB8-903C-4996-B1D3-E9A86ED4BBCF}
HKEY_CLASSES_ROOT\Interface\{6876543E-DA55-4F90-9CD2-5ED380D9516C}
HKEY_CLASSES_ROOT\Interface\{701E8C3A-7910-4CCD-A9F8-7B9A5F5B3947}
HKEY_CLASSES_ROOT\Interface\{850300D6-D53B-4720-9372-6D31B85537E1}
HKEY_CLASSES_ROOT\Interface\{8C803228-BD61-4744-8B79-949E3F512DDC}
HKEY_CLASSES_ROOT\Interface\{B7C685F0-1804-4382-A8EF-17D33DF97069}
HKEY_CLASSES_ROOT\TypeLib\{244B730E-D899-4E38-9428-03D1143242E0}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{330A77C2-C15A-43B5-055C-B4E35EAED279}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{001501E7-C970-4CB1-9740-E055BF3DDFD6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FBBBC44-296D-4A2F-AF45-BE1EE387F569}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{163469FD-6009-48E2-AD8C-47BB2E0D88BE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1694E5C6-9E1F-4C3B-B79A-828C2FC40003}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{200BD3A6-A02B-4BAC-A364-A9D8017E3C4E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{20C59F9F-33CB-4B1B-AFB6-B710DB845709}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D80835-4A3A-4572-9F5F-3F24A7A28AE5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{255CDDA3-576B-44C9-B944-46EAC18D5D6F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3261F690-1CA4-4839-928B-F4F898B74EB7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37B9988B-1997-41F4-A832-DAE42CC3F7C2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B861FB8-903C-4996-B1D3-E9A86ED4BBCF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6876543E-DA55-4F90-9CD2-5ED380D9516C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{701E8C3A-7910-4CCD-A9F8-7B9A5F5B3947}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{850300D6-D53B-4720-9372-6D31B85537E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8C803228-BD61-4744-8B79-949E3F512DDC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7C685F0-1804-4382-A8EF-17D33DF97069}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{244B730E-D899-4E38-9428-03D1143242E0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyFalcon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyFalcon
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SOFTWARE\SpyFalcon


Version 2.19

Ajout de l'utilitaire swsc.exe (SteelWerx) pour supprimer des services.

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Uninstall]

%SYSTEM%\msnscps.dll
[-HKEY_CLASSES_ROOT\AppID\{78364D99-A640-4ddf-B91A-67EFF8373045}]
[-HKEY_CLASSES_ROOT\CLSID\{78364D99-A640-4ddf-B91A-67EFF8373045}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{78364D99-A640-4ddf-B91A-67EFF8373045}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78364D99-A640-4ddf-B91A-67EFF8373045}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78364D99-A640-4ddf-B91A-67EFF8373045}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"=-

O4 - HKLM\..\Run: [AlfaCleaner]
%DESKTOP%\AlfaCleaner.lnk
C:\Documents and Settings\LocalService\Application Data\AlfaCleaner\
C:\Documents and Settings\user\Application Data\AlfaCleaner\
C:\Documents and Settings\user\Application Data\Skinux\
C:\Documents and Settings\All Users\Menu D�marrer\Programmes\AlfaCleaner\
C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\AlfaCleaner.lnk
C:\Program Files\AlfaCleaner\
%SYSTEM%\drivers\hesvc.sys

O23 - Service: AlfaCleanerService - AlfaCleaner.com - C:\Program Files\AlfaCleaner\ACServer.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AlfaCleaner.com_is1]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANER]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANERSERVICE]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\System\AlfaCleanerService]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\alfacleaner]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AlfaCleanerService]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANERSERVICE]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\alfacleaner]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\AlfaCleanerService]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\System\AlfaCleanerService]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANER]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANERSERVICE]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\alfacleaner]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AlfaCleanerService]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\AlfaCleanerService]


Version 2.18

Utilisation de SrchSTS.exe pour la recherche des dll SharedTaskScheduler

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spy Sheriff

%SYSTEM%\intell321.exe
O4 - HKLM\..\Run: [intell321.exe]

%WINDOWS%\sachostx.exe
O4 - HKLM\..\Run: [HostSrv]

%SYSTEM%\sachostc.exe
%SYSTEM%\sachostp.exe
%SYSTEM%\sachosts.exe
%SYSTEM%\maxd64.exe
%SYSTEM%\paradise.raw.exe
%SYSTEM%\vxgame?.exe????.exe.bak
%SYSTEM%\vxgamet?.exe?????.exe

%WINDOWS%\uninstDsk.exe

%SYSTEM%\vxgame2.exe3584.exe
O4 - HKCU\..\Run: [WinMedia]

%WINDOWS%\inet20001\

%SYSTEM%\IeHelperEx.dll
HKEY_CLASSES_ROOT\CLSID\{673BA504-3DDA-4851-8B3C-37AE54E2D688}
HKEY_CLASSES_ROOT\CLSID\{BA12780E-B91E-41A7-A51A-528CBD64284E}
HKEY_CLASSES_ROOT\Interface\{57F88FBD-FFD2-4AF2-B138-CD644A8E62B5}
HKEY_CLASSES_ROOT\Interface\{9EF3F6BA-1BF9-4B4E-9475-437A02DBFA8B}
HKEY_CLASSES_ROOT\SpecSoft2.BrowserHook
HKEY_CLASSES_ROOT\SpecSoft2.BrowserHook.1
HKEY_CLASSES_ROOT\SpecSoft2.IExplorerHelper
HKEY_CLASSES_ROOT\SpecSoft2.IExplorerHelper.1
HKEY_CLASSES_ROOT\TypeLib\{B82C3D8C-F764-4B4E-8272-DC1185CE12FC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{673BA504-3DDA-4851-8B3C-37AE54E2D688}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA12780E-B91E-41A7-A51A-528CBD64284E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{57F88FBD-FFD2-4AF2-B138-CD644A8E62B5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9EF3F6BA-1BF9-4B4E-9475-437A02DBFA8B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpecSoft2.BrowserHook
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpecSoft2.BrowserHook.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpecSoft2.IExplorerHelper
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpecSoft2.IExplorerHelper.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B82C3D8C-F764-4B4E-8272-DC1185CE12FC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA12780E-B91E-41A7-A51A-528CBD64284E}


Version 2.17

%system%\dxmpp.dll
[-HKEY_CLASSES_ROOT\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}"=-


Version 2.16

%WINDOWS%\inet20010\

%WINDOWS%\winsysupd.exe
O4 - HKLM\..\Run: [winsysupd]

%WINDOWS%\winsysban.exe
O4 - HKLM\..\Run: [winsysban]

%SYSTEM%\symsvcsa.exe

%system%\replmap.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{D81E2FC4-B0A2-11D3-21AC-07C04C21A18A}"="Replay for WindowsXP"
[-HKEY_CLASSES_ROOT\CLSID\{D81E2FC4-B0A2-11D3-21AC-07C04C21A18A}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{D81E2FC4-B0A2-11D3-21AC-07C04C21A18A}]

O4 - HKLM\..\Run: [A.tmp] %TEMP%\A.tmp.exe
O4 - HKLM\..\Run: [B.tmp] %TEMP%\B.tmp.exe
O4 - HKLM\..\Run: [A.tmp.exe] %TEMP%\A.tmp.exe
O4 - HKLM\..\Run: [B.tmp.exe] %TEMP%\B.tmp.exe

O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\System32\hp????.tmp
[-HKEY_CLASSES_ROOT\CLSID\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22}]


Version 2.15

%HOMEDRIVE%\ntnc.exe

O4 - HKLM\..\Run: [C.tmp] %TEMP%\C.tmp.exe
O4 - HKLM\..\Run: [D.tmp] %TEMP%\D.tmp.exe
O4 - HKLM\..\Run: [C.tmp.exe] %TEMP%\C.tmp.exe
O4 - HKLM\..\Run: [D.tmp.exe] %TEMP%\D.tmp.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{31EE3286-D785-4E3F-95FC-51D00FDABC01}"="Master Browseui"
[HKEY_CLASSES_ROOT\CLSID\{31EE3286-D785-4E3F-95FC-51D00FDABC01}]
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{31EE3286-D785-4E3F-95FC-51D00FDABC01}]


Version 2.14

Remplacement de l'utilitaire du registre reg.exe [Microsoft] par wsreg.exe [SteelWerx]
Nettoyage %TEMP%

%WINDOWS%\sdkqq.exe
O4 - HKLM\..\Run: [sdkqq.exe]

%WINDOWS%\d3dn32.exe
O4 - HKLM\..\Run: [d3dn32.exe]

%WINDOWS%\d3pb.exe
O4 - HKLM\..\Run: [d3pb.exe]

%SYSTEM%\sysjv32.exe
O4 - HKLM\..\Run: [sysjv32.exe]

O2 - BHO: Class - {FEFEC367-0557-50DA-92D8-EFF9A710070B}
%WINDOWS%\d3??.dll
HKEY_CLASSES_ROOT\CLSID\{FEFEC367-0557-50DA-92D8-EFF9A710070B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FEFEC367-0557-50DA-92D8-EFF9A710070B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
{FEFEC367-0557-50DA-92D8-EFF9A710070B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FEFEC367-0557-50DA-92D8-EFF9A710070B}

%userprofile%\Menu D�marrer\Programmes\SpywareStrike\
%userprofile%\Menu D�marrer\SpywareStrike 2.5.lnk
%DESKTOP%\SpywareStrike.lnk
%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareStrike 2.5.lnk

%SYSTEM%\wiatwain.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
{C1A2FDA2-2A5B-2C8A-F2A2-BA2DB3A2C31C}=WaitWain for Windows
HKEY_CLASSES_ROOT\CLSID\{C1A2FDA2-2A5B-2C8A-F2A2-BA2DB3A2C31C}
HKEY_CURRENT_USER\Software\Classes\CLSID\{C1A2FDA2-2A5B-2C8A-F2A2-BA2DB3A2C31C}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curre

HKEY_LOCAL_MACHINE\SOFTWARE\SpywareStrike

HKEY_CLASSES_ROOT\AppID\SpywareStrike.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\SpywareStrike.EXE

HKEY_CLASSES_ROOT\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareStrike.exe

HKEY_CLASSES_ROOT\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32
InprocServer32=Fs99c'tvV9[6a*%9La^qToolbox>M5KDYSUnf(HA*L[xeX)y

HKEY_CLASSES_ROOT\CLSID\{0F25878F-F8AE-5D5D-2BB7-31B5F803290D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F25878F-F8AE-5D5D-2BB7-31B5F803290D}

HKEY_CLASSES_ROOT\Interface\{2C15CDEA-3EF4-4405-90B0-19A1389B36ED}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C15CDEA-3EF4-4405-90B0-19A1389B36ED}

HKEY_CLASSES_ROOT\Interface\{3115A433-3FA0-483B-AB01-2A61C951FE58}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3115A433-3FA0-483B-AB01-2A61C951FE58}

HKEY_CLASSES_ROOT\Interface\{51FEFA9C-1D5A-41C4-81FE-8C0FBE9254F0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{51FEFA9C-1D5A-41C4-81FE-8C0FBE9254F0}

HKEY_CLASSES_ROOT\Interface\{5CCC8D01-9F75-4F07-9ACF-DEB314176C79}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5CCC8D01-9F75-4F07-9ACF-DEB314176C79}

HKEY_CLASSES_ROOT\Interface\{5E7BF614-960B-4A1F-9236-9EC01AC4C5E2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5E7BF614-960B-4A1F-9236-9EC01AC4C5E2}

HKEY_CLASSES_ROOT\Interface\{66F0AC1C-DED5-4965-9E31-39788DF1B264}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66F0AC1C-DED5-4965-9E31-39788DF1B264}

HKEY_CLASSES_ROOT\Interface\{849E056A-D67A-431E-9370-2275F26D39B5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{849E056A-D67A-431E-9370-2275F26D39B5}

HKEY_CLASSES_ROOT\Interface\{8B7AFBFD-631C-45BA-9145-F059EB58DD73}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7AFBFD-631C-45BA-9145-F059EB58DD73}

HKEY_CLASSES_ROOT\Interface\{AFEB8519-0B8B-4023-8C15-FFB17D5225F9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AFEB8519-0B8B-4023-8C15-FFB17D5225F9}

HKEY_CLASSES_ROOT\Interface\{BA9CC151-4581-438E-94AF-4C703201B7CA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA9CC151-4581-438E-94AF-4C703201B7CA}

HKEY_CLASSES_ROOT\Interface\{BC74C336-FF2C-40C9-AD4E-3772C208406B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC74C336-FF2C-40C9-AD4E-3772C208406B}

HKEY_CLASSES_ROOT\Interface\{BDF00F24-A571-4392-95EC-04FDFF82A82C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BDF00F24-A571-4392-95EC-04FDFF82A82C}

HKEY_CLASSES_ROOT\Interface\{C4E953E6-770E-4F59-A5E3-43E9F0D682E2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4E953E6-770E-4F59-A5E3-43E9F0D682E2}

HKEY_CLASSES_ROOT\Interface\{E0105E7C-D0C4-4DEA-AA21-B02F2960ECAF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E0105E7C-D0C4-4DEA-AA21-B02F2960ECAF}

HKEY_CLASSES_ROOT\Interface\{ED39CB7C-1BF6-429B-A275-F183B4A3EFCB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED39CB7C-1BF6-429B-A275-F183B4A3EFCB}

HKEY_CLASSES_ROOT\Interface\{F23AA637-31D5-4526-B5C6-9FF89E16202C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F23AA637-31D5-4526-B5C6-9FF89E16202C}

HKEY_CLASSES_ROOT\TypeLib\{C1A4C0C9-DBD0-493A-93F8-0B05EDC96224}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C1A4C0C9-DBD0-493A-93F8-0B05EDC96224}


Version 2.13

%HOMEDRIVE%\ntps.exe

O4 - HKLM\..\Run: [links.exe]
%SYSTEM%\links.exe

O4 - HKLM\..\Run: [sysen.exe]
%WINDOWS%\sysen.exe
HKEY_CLASSES_ROOT\CLSID\{29D3E589-2DCC-699E-1A0F-61AF30BAA3A4}
HKLM\SOFTWARE\Classes\CLSID\{29D3E589-2DCC-699E-1A0F-61AF30BAA3A4}

O2 - BHO: Class - {9114249C-F5E5-36A3-4480-169B869E0556}
%WINDOWS%\sdkcb.dll
HKEY_CLASSES_ROOT\CLSID\{9114249C-F5E5-36A3-4480-169B869E0556}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9114249C-F5E5-36A3-4480-169B869E0556}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
{9114249C-F5E5-36A3-4480-169B869E0556}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9114249C-F5E5-36A3-4480-169B869E0556}

O4 - HKLM\..\Run: [ieyi.exe]
%WINDOWS%\ieyi.exe
HKEY_CLASSES_ROOT\CLSID\{C1212066-16A4-F478-E898-BC64A80D4908}
HKLM\SOFTWARE\Classes\CLSID\{C1212066-16A4-F478-E898-BC64A80D4908}

O2 - BHO: Class - {66BD9D4C-FAF3-38B9-F43F-169E15DB1A3C}
%WINDOWS%\ieyi.dll
HKEY_CLASSES_ROOT\CLSID\{66BD9D4C-FAF3-38B9-F43F-169E15DB1A3C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66BD9D4C-FAF3-38B9-F43F-169E15DB1A3C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
{66BD9D4C-FAF3-38B9-F43F-169E15DB1A3C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{66BD9D4C-FAF3-38B9-F43F-169E15DB1A3C}


Version 2.12

Clean Manager / Nettoyage de Disque

%windows%\System\csrss.exe
O4 - HKLM\..\Run: [CsRss] C:\WINDOWS\System\csrss.exe

%windows%\country.exe
%windows%\timessquare1.dat

%windows%\drsmartload.dat
%windows%\drsmartloadb1.dat
%homedrive%\drsmartloadb.exe
HKLM\SOFTWARE\Microsoft\drsmartload
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe

HKEY_LOCAL_MACHINE\SOFTWARE\muwq

%SYSTEM%\netwrap.dll
%PROGRAMFILES%\SpywareStrike\
O4 - HKLM\..\Run: [SpywareStrike]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareStrike
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
"{C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D}"="NetWrap for Windows"
HKEY_CLASSES_ROOT\CLSID\{C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D}
HKEY_CURRENT_USER\Software\Classes\CLSID\{C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D}
O2 - BHO: HomepageBHO - {27150f81-0877-42e9-af13-55e5a3439a26} - C:\WINDOWS\system32\hp????.tmp
HKEY_CLASSES_ROOT\CLSID\{27150f81-0877-42e9-af13-55e5a3439a26}
HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{27150f81-0877-42e9-af13-55e5a3439a26}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27150f81-0877-42e9-af13-55e5a3439a26}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27150f81-0877-42e9-af13-55e5a3439a26}

%system%\browsela.dll
O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\browsela


Version 2.11

%ProgramFiles%\Common Files\VCClient\*.*
O4 - HKCU\..\Run: [CU2]
O4 - HKCU\..\Run: [CU1]

%windows%\adtech2006a.exe
O4 - HKLM\..\Run: [adtech2006]

%windows%\batserv2.exe
O4 - HKLM\..\Run: [BatSrv]

%windows%\sysldr32.exe
O4 - HKLM\..\Run: [SystemLoader]

%system%\msvcp.exe
O4 - HKLM\..\Run: [Microsoft Office]

%userprofile%\Menu D�marrer\Programmes\SpyAxe
%userprofile%\Menu D�marrer\SpyAxe 3.0.lnk

%windows%\adsldpbe.dll
O2 - BHO: C:\WINDOWS\adsldpbe.dll - {7507739F-BC2E-4DC3-B233-816783C25DC9}
HKEY_CLASSES_ROOT\CLSID\{7507739F-BC2E-4DC3-B233-816783C25DC9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7507739F-BC2E-4DC3-B233-816783C25DC9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7507739F-BC2E-4DC3-B233-816783C25DC9}

%windows%\adsldpbf.dll
O2 - BHO: C:\WINDOWS\adsldpbf.dll - {EEE7178C-BBC3-4153-9DDE-CD0E9AB1B5B6}
HKEY_CLASSES_ROOT\CLSID\{EEE7178C-BBC3-4153-9DDE-CD0E9AB1B5B6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE7178C-BBC3-4153-9DDE-CD0E9AB1B5B6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE7178C-BBC3-4153-9DDE-CD0E9AB1B5B6}

HKEY_CLASSES_ROOT\CLSID\{957bab51-81ff-8195-f273-d7e286ea702f}
HKEY_CLASSES_ROOT\interface\{0f68a8aa-a9a8-4711-be36-ae363efa6443}
HKEY_CLASSES_ROOT\interface\{28420952-c82b-47d9-a042-fa2217d8a082}
HKEY_CLASSES_ROOT\interface\{3c099c83-8587-4b35-8af0-fc3a169ce14f}
HKEY_CLASSES_ROOT\interface\{3fe13f31-e890-4c37-8213-4b5f9a511c26}
HKEY_CLASSES_ROOT\interface\{4cad27dc-1b60-42f4-820e-316fe0a13512}
HKEY_CLASSES_ROOT\interface\{54874d12-c0c6-44cc-83fb-2c35202f881b}
HKEY_CLASSES_ROOT\interface\{54a3200b-d76e-48d1-b35c-d87eaf6d90bd}
HKEY_CLASSES_ROOT\interface\{663dfe59-032c-46fb-a09a-ffc2dc074f54}
HKEY_CLASSES_ROOT\interface\{69ce4fbc-4861-4206-8211-dd5a9ee79ad3}
HKEY_CLASSES_ROOT\interface\{afa9056f-aa11-4771-ae01-04ecfde18206}
HKEY_CLASSES_ROOT\interface\{b8f2487f-aa6a-4914-9a3f-db84e6868d66}
HKEY_CLASSES_ROOT\interface\{e4645720-e02f-4bb2-8e6d-be7653dd1bf2}
HKEY_CLASSES_ROOT\interface\{fa46b160-c9dd-4040-b9d9-ccf5d3db5438}
HKEY_CLASSES_ROOT\interface\{fc1f0c2c-8117-427d-816c-215b68524f74}
HKEY_CLASSES_ROOT\interface\{fd1eee96-8dc7-478d-be3b-7d06ac67fb66}
HKEY_CLASSES_ROOT\interface\{fd8e5ed7-0091-416f-a55b-1d072d58a24f}


Version 2.10

O2 - BHO: HomepageBHO - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\system32\hp????.tmp
HKEY_CLASSES_ROOT\CLSID\{e0103cd4-d1ce-411a-b75b-4fec072867f4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0103cd4-d1ce-411a-b75b-4fec072867f4}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{e0103cd4-d1ce-411a-b75b-4fec072867f4}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e0103cd4-d1ce-411a-b75b-4fec072867f4}

%system%\wbeconm.dll
HKEY_CLASSES_ROOT\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
HKEY_CURRENT_USER\Software\Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}"="Security Update"


Version 2.09

O2 - BHO: HomepageBHO - {7288c0bd-7f2f-4229-a0c4-3c90a6e2a881} - C:\WINDOWS\system32\hp???.tmp
HKEY_CLASSES_ROOT\CLSID\{7288C0BD-7F2F-4229-A0C4-3C90A6E2A881}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7288C0BD-7F2F-4229-A0C4-3C90A6E2A881}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{7288c0bd-7f2f-4229-a0c4-3c90a6e2a881}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7288c0bd-7f2f-4229-a0c4-3c90a6e2a881}

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP


Version 2.08

%system%\windesktop.dll
%system%\windesktop.exe
O4 - HKLM\..\Run: [windesktop]
O4 - HKLM\..\RunServices: [windesktop]

O2 - BHO: HomepageBHO - {1ca480cd-c0e5-4548-874e-b85b17905b3a} - C:\WINDOWS\System32\hp????.tmp
HKEY_CLASSES_ROOT\CLSID\{1ca480cd-c0e5-4548-874e-b85b17905b3a}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ca480cd-c0e5-4548-874e-b85b17905b3a}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{1ca480cd-c0e5-4548-874e-b85b17905b3a}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ca480cd-c0e5-4548-874e-b85b17905b3a}


Version 2.07

%windir%\System\svchost.dll
%windir%\System\svwhost.exe
%windir%\System\svwhost.dll
%system%\mspostsp.exe
%system%\kernels64.exe
%windows%\inet20066\*.*

%windows%\update13.js
O4 - HKLM\..\RunOnce: [tlc]

%system%\NTCommLib3.exe
%system%\tcpservice2.exe
%system%\wstart.dll
O4 - HKLM\..\Run: [NTCommLib3]
HKEY_CLASSES_ROOT\AppID\{F6BDB4E5-D6AA-4D1F-8B67-BCB0F2246E21}
HKEY_CLASSES_ROOT\AppID\WStart.DLL
HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}
HKEY_CLASSES_ROOT\WStart.WHttpHelper
HKEY_CLASSES_ROOT\WStart.WHttpHelper.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F6BDB4E5-D6AA-4D1F-8B67-BCB0F2246E21}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\WStart.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9896231A-C487-43A5-8369-6EC9B0A96CC0}
HKEY_LOCAL_MACHINE\SOFTWARE\WSoft

%system%\child.dll
HKEY_CLASSES_ROOT\CLSID\{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}
HKEY_CURRENT_USER\Software\Classes\CLSID\{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
"{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}"="OutPost FireWall"

%system%\chp.dll
HKEY_CLASSES_ROOT\CLSID\{429F4BB8-7BF7-4152-8011-3C6F9EB7E892}
HKEY_CURRENT_USER\Software\Classes\CLSID\{429F4BB8-7BF7-4152-8011-3C6F9EB7E892}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{429F4BB8-7BF7-4152-8011-3C6F9EB7E892}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{429F4BB8-7BF7-4152-8011-3C6F9EB7E892}"="Module"

%system%\bre.dll
%system%\bre32.dll
HKEY_CLASSES_ROOT\CLSID\{203B1C4D9-BC71-8916-38AD-9DEA5D213614}
HKEY_CURRENT_USER\Software\Classes\CLSID\{203B1C4D9-BC71-8916-38AD-9DEA5D213614}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{203B1C4D9-BC71-8916-38AD-9DEA5D213614}"="OLE Module"

%system%\trf32.dll
HKEY_CLASSES_ROOT\CLSID\{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}
HKEY_CURRENT_USER\Software\Classes\CLSID\{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}"="OLE Module"

%system%ioctrl.dll
HKEY_CLASSES_ROOT\CLSID\{C1A8B6A1-2C81-1C3D-A3C6-A1CCDB10B47F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1A8B6A1-2C81-1C3D-A3C6-A1CCDB10B47F}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C1A8B6A1-2C81-1C3D-A3C6-A1CCDB10B47F}"="Windows Update"


Version 2.06

O4 - HKLM\..\Run: [3.tmp]
O4 - HKLM\..\Run: [4.tmp]
O4 - HKLM\..\Run: [3.tmp.exe]
O4 - HKLM\..\Run: [4.tmp.exe]


Version 2.05

O2 - BHO: HomepageBHO - {724510c3-f3c8-4fb7-879a-d99f29008a2f} - C:\WINDOWS\System32\hp????.tmp
HKEY_CLASSES_ROOT\CLSID\{724510C3-F3C8-4FB7-879A-D99F29008A2F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{724510C3-F3C8-4FB7-879A-D99F29008A2F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{724510c3-f3c8-4fb7-879a-d99f29008a2f}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{724510c3-f3c8-4fb7-879a-d99f29008a2f}


Version 2.04

%HOMEDRIVE%\xxx.exe
%userprofile%\desktop\asfds
%userprofile%\desktop\cdegfr
%userprofile%\desktop\fdsf
%userprofile%\desktop\sdfdsf
%userprofile%\desktop\sdfff
%userprofile%\desktop\wdcevf
%userprofile%\desktop\wdcsadsad
%userprofile%\desktop\zxczxc
%system%\cmd32.exe
%system%\dial23.exe
%system%\exeha2.exe
%system%\exeha3.exe
%system%\z11.exe
%system%\z12.exe
%system%\z13.exe
%system%\z14.exe
%system%\z15.exe
%system%\z16.exe
%windows%\icont.exe
%windows%\inet20099\*.*

F3 - REG:win.ini: run=C:\WINDOWS\inet20099\winlogon.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
"run"="C:\WINDOWS\inet20099\winlogon.exe"

O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20099\3.00.11.dll
HKEY_CLASSES_ROOT\CLSID\{5321E378-FFAD-4999-8C62-03CA8155F0B3}
HKEY_CLASSES_ROOT\Replace.HBO
HKEY_CLASSES_ROOT\Replace.HBO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5321E378-FFAD-4999-8C62-03CA8155F0B3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Replace.HBO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Replace.HBO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5321E378-FFAD-4999-8C62-03CA8155F0B3}

O4 - HKCU\..\Run: [pro]
O4 - HKCU\..\Run: [xp_system]
O4 - HKLM\..\Run: [xp_system]
O4 - HKLM\..\Run: [Microsoft standard protector]


Version 2.03

O2 - BHO: HomepageBHO - {3e9b951e-6f72-431b-82cf-4a9fbf2f53bc} - C:\WINDOWS\system32\hp????.tmp
HKEY_CLASSES_ROOT\CLSID\{3E9B951E-6F72-431B-82CF-4A9FBF2F53BC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E9B951E-6F72-431B-82CF-4A9FBF2F53BC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{3e9b951e-6f72-431b-82cf-4a9fbf2f53bc}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3e9b951e-6f72-431b-82cf-4a9fbf2f53bc}


Version 2.02

C:\WINDOWS\bxproxy.exe
C:\WINDOWS\System32\bnmsrv.exe
C:\WINDOWS\System32\RpcxSs.dll
O4 - HKCU\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe
O4 - HKLM\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_RPCXSS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcxSs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RPCXSS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcxSs


Version 2.01

%system%\~update.exe
%system%\ll.exe
%system%\bhoimpl.dll
%system%\ztoolbar.bmp
%system%\ztoolbar.xml

O2 - BHO: MyBHO - {784aa380-13f2-422e-8540-f2280f1dd4f1} - C:\WINDOWS\System32\bhoimpl.dll
HKEY_CLASSES_ROOT\AppID\{77a7d7ab-576a-4b90-b4ee-909093c3bc69}
HKEY_CLASSES_ROOT\AppID\MyBHOImpl.DLL
HKEY_CLASSES_ROOT\CLSID\{784aa380-13f2-422e-8540-f2280f1dd4f1}
HKEY_CLASSES_ROOT\Interface\{71237FD0-9DF9-46B3-8F1C-6F2998543EA2}
HKEY_CLASSES_ROOT\TDS.MyBHO
HKEY_CLASSES_ROOT\TDS.MyBHO.1
HKEY_CLASSES_ROOT\TypeLib\{77A7D7AB-576A-4B90-B4EE-909093C3BC69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{77a7d7ab-576a-4b90-b4ee-909093c3bc69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MyBHOImpl.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{784aa380-13f2-422e-8540-f2280f1dd4f1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71237FD0-9DF9-46B3-8F1C-6F2998543EA2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TDS.MyBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TDS.MyBHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{77A7D7AB-576A-4B90-B4EE-909093C3BC69}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{784aa380-13f2-422e-8540-f2280f1dd4f1}
HKEY_LOCAL_MACHINE\SOFTWARE\TDS

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{F33812FB-F35C-4674-90F6-FD757C419C51}"="DDE"


Version 2.00

%system%\ot.ico
%system%\ts.ico
%system%\migicons.exe
%system%\1024\
%ProgramFiles%\SpyAxe\

O4 - HKLM\..\Run: [SpyAxe]

HKEY_CLASSES_ROOT\CLSID\{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}
HKEY_CLASSES_ROOT\CLSID\{E802FFFF-8E58-4d2c-A435-8BEEFB10AB77}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\SpyAxe.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5} <-- Allready deleted with SpywareStrike
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06506B3A-857D-431f-BE0B-038B1EC386B3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BFF94F7-9748-43d1-BAC4-D963351B63E7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0C580891-CA9D-4619-BDC9-85378EB65931}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53525A6C-3774-4b47-B317-BC7DFE4FC7ED}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5DEB9A24-19E0-49e6-A6B2-110BC3E1062A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E1ACE2A-8638-4775-8AA9-5C187AD40A82}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{629C4FE9-B627-4905-AF5B-AD652BB1B5C5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{659F78EA-6FF2-40f8-8EA3-06F7418A209E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7616A7F7-DF99-432f-870D-4AFEA0D079F4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7EB22F36-2CCD-4003-89EE-6CF40EBC4282}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0D06AA3-499B-4156-9FFD-0BE236F0D4E5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B6610F1D-DA77-42c4-8300-721D9DA9D70B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Backup
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Backup.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.EngineListener
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.EngineListener.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Log
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Log.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.LogRecord
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.LogRecord.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Paths
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Paths.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Quarantine
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Quarantine.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.RunAs.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Scanner
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.Scanner.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.SearchItem
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.SearchItem.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.ThreatCollection
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyAxe.ThreatCollection.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2BB3BCBF-411A-4C67-8E69-F4BB301DC333}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\spyaxe.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyAxe
HKEY_LOCAL_MACHINE\SOFTWARE\SpyAxe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}
{E802FFFF-8E58-4d2c-A435-8BEEFB10AB77}


Version 1.99

%HOMEDRIVE%\contextplus.exe
%HOMEDRIVE%\drsmartload1.exe
%windir%\notepad.com
%windir%\psg.exe
%windir%\rzs.exe
%windir%\sec.exe
%system%\msbe.dll
%system%\notepad.com
%system%\nvms.dll
%system%\shdochp.dll
%system%\shdochp.exe
%system%\shsexl32.dll
%system%\x.exe
%ProgramFiles%\WinHound\
C:\Documents and Settings\****\Desktop\access
C:\Documents and Settings\****\Desktop\domains
C:\Documents and Settings\****\Desktop\map.txt
C:\Documents and Settings\All Users\Desktop\WinHound spyware remover.lnk
%allusersprofile%\Menu D�marrer\Programmes\WinHound spyware remover
O4 - HKLM\..\Run: [FHPage]
O4 - HKLM\..\Run: [WinHound]
HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinHound spyware remover
HKEY_CLASSES_ROOT\CLSID\{0878F045-B52E-46B3-9724-D3AE69D50067}
HKEY_CLASSES_ROOT\CLSID\{0EA04667-E53B-4E81-8E7C-DE2CA114CBD6}
HKEY_CLASSES_ROOT\CLSID\{265C2AF8-C94C-4AFF-B2B6-340D3982562C}
HKEY_CLASSES_ROOT\CLSID\{3946A33D-BBC6-4792-A383-D855E0F76D91}
HKEY_CLASSES_ROOT\CLSID\{41D7BB0A-64E0-4AB2-BD0B-69EA78E462E8}
HKEY_CLASSES_ROOT\CLSID\{4AA55E8C-2C19-4F3A-91EC-43B6DF937C4F}
HKEY_CLASSES_ROOT\CLSID\{4F93062D-7BDA-48BE-AEB6-88AF2B1FE2D4}
HKEY_CLASSES_ROOT\CLSID\{5206DF89-97FC-41AD-BAE3-993E87053A99}
HKEY_CLASSES_ROOT\CLSID\{58E68548-42E2-479D-A9E0-86D9F2EAF02E}
HKEY_CLASSES_ROOT\CLSID\{5E5A79A6-C67B-444E-BE58-BD0ACEFCDA07}
HKEY_CLASSES_ROOT\CLSID\{67196B3E-55A0-49DE-BA11-66F07DF804DB}
HKEY_CLASSES_ROOT\CLSID\{7198F8DA-012C-4DB4-ABD8-923A54C87900}
HKEY_CLASSES_ROOT\CLSID\{82847700-FE61-46A3-B3EE-761A1E312ACA}
HKEY_CLASSES_ROOT\CLSID\{8C2A05C5-780F-4A2E-AE1C-FB8181F860E4}
HKEY_CLASSES_ROOT\CLSID\{8DCA6B3D-1FCA-4500-B210-76119BB5C69E}
HKEY_CLASSES_ROOT\CLSID\{ACC647EE-991A-4811-B420-F063F50CDDC1}
HKEY_CLASSES_ROOT\CLSID\{C5B70256-5B08-4056-B84E-C6CE084967F5}
HKEY_CLASSES_ROOT\CLSID\{CBE4B748-08F9-44DB-8FB1-9AD25979DA35}
HKEY_CLASSES_ROOT\CLSID\{CDD964C2-FB78-4A74-BB1E-1CB1FCB72018}
HKEY_CLASSES_ROOT\CLSID\{D25F7446-4D36-4203-9EA5-5422B26FA9D0}
HKEY_CLASSES_ROOT\CLSID\{E12AAACF-8AF2-4C31-BA94-E3787B44F90E}
HKEY_CLASSES_ROOT\CLSID\{E479197F-49E5-4E60-9FA2-A71D4C7C2BBC}
HKEY_CLASSES_ROOT\CLSID\{F880B4F2-75BF-44EC-B7AA-45EC37448027}
HKEY_CLASSES_ROOT\TypeLib\{31E956BF-8CA9-4D75-B534-7EBC79770002}
HKEY_CLASSES_ROOT\TypeLib\{6E9E448E-B195-4627-953C-5377FA9BBA36}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0878F045-B52E-46B3-9724-D3AE69D50067}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EA04667-E53B-4E81-8E7C-DE2CA114CBD6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{265C2AF8-C94C-4AFF-B2B6-340D3982562C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3946A33D-BBC6-4792-A383-D855E0F76D91}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41D7BB0A-64E0-4AB2-BD0B-69EA78E462E8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4AA55E8C-2C19-4F3A-91EC-43B6DF937C4F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F93062D-7BDA-48BE-AEB6-88AF2B1FE2D4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5206DF89-97FC-41AD-BAE3-993E87053A99}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58E68548-42E2-479D-A9E0-86D9F2EAF02E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5A79A6-C67B-444E-BE58-BD0ACEFCDA07}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67196B3E-55A0-49DE-BA11-66F07DF804DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7198F8DA-012C-4DB4-ABD8-923A54C87900}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82847700-FE61-46A3-B3EE-761A1E312ACA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C2A05C5-780F-4A2E-AE1C-FB8181F860E4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8DCA6B3D-1FCA-4500-B210-76119BB5C69E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ACC647EE-991A-4811-B420-F063F50CDDC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C5B70256-5B08-4056-B84E-C6CE084967F5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CBE4B748-08F9-44DB-8FB1-9AD25979DA35}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDD964C2-FB78-4A74-BB1E-1CB1FCB72018}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D25F7446-4D36-4203-9EA5-5422B26FA9D0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E12AAACF-8AF2-4C31-BA94-E3787B44F90E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E479197F-49E5-4E60-9FA2-A71D4C7C2BBC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F880B4F2-75BF-44EC-B7AA-45EC37448027}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31E956BF-8CA9-4D75-B534-7EBC79770002}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6E9E448E-B195-4627-953C-5377FA9BBA36}

O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
HKEY_CLASSES_ROOT\CLSID\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}
HKEY_CLASSES_ROOT\NLS.UrlCatcher
HKEY_CLASSES_ROOT\NLS.UrlCatcher.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NLS.UrlCatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NLS.UrlCatcher.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}

O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
HKEY_CLASSES_ROOT\ADP.UrlCatcher
HKEY_CLASSES_ROOT\ADP.UrlCatcher.1
HKEY_CLASSES_ROOT\CLSID\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADP.UrlCatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADP.UrlCatcher.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}

O2 - BHO: HomepageBHO - {7caf96a2-c556-460a-988e-76fc7895d284} - C:\WINDOWS\system32\hp????.tmp
HKEY_CLASSES_ROOT\CLSID\{7caf96a2-c556-460a-988e-76fc7895d284}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7caf96a2-c556-460a-988e-76fc7895d284}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{7caf96a2-c556-460a-988e-76fc7895d284}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7caf96a2-c556-460a-988e-76fc7895d284}


Version 1.98

%HOMEDRIVE%\ecsiin.stub.exe
%HOMEDRIVE%\stub_113_4_0_4_0.exe
%windir%\adtech2005.exe
%windir%\secure32.html
%windir%\timessquare.exe
%windir%\toolbar.exe
%system%\sywsvcs.exe
%ProgramFiles%\Fichiers communs\muwq\
%ProgramFiles%\SpyAxe\
O4 - HKLM\..\Run: [ecsiin]
O4 - HKLM\..\Run: [timessquare]
O4 - HKLM\..\Run: [adtech2005]
O4 - HKCU\..\Run: [muwq]
O4 - HKCU\..\Run: [qwum]
O16 - DPF: {10003000-1000-0000-1000-000000000000}


Version 1.97

%ProgramFiles%\Fichiers communs\Download\mc-58-12-0000113.exe
%ProgramFiles%\Common Files\Download\mc-58-12-0000113.exe
%ProgramFiles%\Fichiers communs\InetGet\mc-58-12-0000113.exe
%ProgramFiles%\Common Files\InetGet\mc-58-12-0000113.exe
%ProgramFiles%\Fichiers communs\Windows\mc-58-12-0000113.exe
%ProgramFiles%\Common Files\Windows\mc-58-12-0000113.exe
%ProgramFiles%\Fichiers communs\Windows\services32.exe
%ProgramFiles%\Common Files\Windows\services32.exe
%allusersprofile%\Menu D�marrer\Programmes\P.S.Guard spyware remover
%system%\msupdate32.dll
%system%\MTC.dll
%system%\MTC.ini
O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-4D54434D5443}
O3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-4D54434D5443}
O4 - HKCU\..\Run: [services32]
O20 - Winlogon Notify: msupdate


Version 1.96

%bureau%\m00.exe
%windir%\adsldpbc.dll
%windir%\q*_disk.dll
%windir%\slassac.dll
%windir%\svchost.exe
%system%\cnymxw32.dll
%system%\prflbmsgp32.dll
%system%\sysbho.exe
%system%\sysmain.dll
%system%\winstyle2.dll
%system%\winstyle3.dll
%system%\winstyle32.dll
O4 - HKLM\..\Run: [System Redirect]
O4 - HKCU\..\Run: [System]
HKEY_CLASSES_ROOT\CLSID\{0976BE78-EA53-4DD6-91E6-E6175940032B}
HKEY_CLASSES_ROOT\CLSID\{16875E09-927B-4494-82BD-158A1CD46BA0}
HKEY_CLASSES_ROOT\CLSID\{405132A4-5DD1-4BA8-A181-95C8D435093A}
HKEY_CLASSES_ROOT\CLSID\{7A7E6D97-B492-4884-9ABB-C31281DCC4F2}
HKEY_CLASSES_ROOT\CLSID\{826B2228-BC09-49F2-B5F8-42CE26B1B712}
HKEY_CLASSES_ROOT\CLSID\{8D82BB89-B58C-4F21-9C5D-377F65947806}
HKEY_CLASSES_ROOT\CLSID\{B212D577-05B7-4963-911E-4A8588160DFA}
HKEY_CLASSES_ROOT\CLSID\{C0E5FF11-4AE0-4699-A6A7-2FB7118F2081}
HKEY_CLASSES_ROOT\CLSID\{C7CF1142-0785-4B12-A280-B64681E4D45E}
HKEY_CLASSES_ROOT\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}
HKEY_CURRENT_USER\Software\Microsoft\style2
HKEY_CURRENT_USER\Software\Microsoft\style3
HKEY_CURRENT_USER\Software\Microsoft\style32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0976BE78-EA53-4DD6-91E6-E6175940032B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{16875E09-927B-4494-82BD-158A1CD46BA0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{405132A4-5DD1-4BA8-A181-95C8D435093A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6AC3806F-8B39-4746-9C38-6B01CB7331FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A7E6D97-B492-4884-9ABB-C31281DCC4F2}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{826B2228-BC09-49F2-B5F8-42CE26B1B712}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D82BB89-B58C-4F21-9C5D-377F65947806}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B212D577-05B7-4963-911E-4A8588160DFA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C0E5FF11-4AE0-4699-A6A7-2FB7118F2081}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7CF1142-0785-4B12-A280-B64681E4D45E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler: [{16875E09-927B-4494-82BD-158A1CD46BA0}]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler: [{6AC3806F-8B39-4746-9C38-6B01CB7331FF}]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler: [{7A7E6D97-B492-4884-9ABB-C31281DCC4F2}]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler: [{B212D577-05B7-4963-911E-4A8588160DFA}]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler: [{C7CF1142-0785-4B12-A280-B64681E4D45E}]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler: [{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gggg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ggggg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\style2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\style32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3i



Version 1.95

%system%\priva.exe
O4 - HKLM\..\Run: [ControlPanel]
O4 - HKLM\..\RunServices: [Explorer64]


Version 1.94

%HOMEDRIVE%\secure32.html
%system%\svchosts.exe
%system%\shdocsvc.dll
%system%\shdocsvc.exe
%system%\ztoolb011.dll
O4 - HKLM\..\Run: [FHStart]


Version 1.93

%windir%\adsldpbd.dll
%system%\multitran.exe
%system%\performent217.dll
%system%\qvxgamet?.exe
%system%\nuclabdll.dll
%system%\st3.dll
%system%\svwhost.exe
%system%\zolker011.dll
C:\Documents and Settings\All Users\Bureau\Blowjob.url
C:\Documents and Settings\All Users\Bureau\Cigarettes Discount.url
C:\Documents and Settings\All Users\Bureau\Forex Trading.url
C:\Documents and Settings\All Users\Bureau\Free Ringtones.url
C:\Documents and Settings\All Users\Bureau\Gift Ideas.url
C:\Documents and Settings\All Users\Bureau\Group Sex.url
C:\Documents and Settings\All Users\Bureau\Home Loan.url
C:\Documents and Settings\All Users\Bureau\Mp3 Download.url
C:\Documents and Settings\All Users\Bureau\Online Casino.url
C:\Documents and Settings\All Users\Bureau\Online Dating.url
C:\Documents and Settings\All Users\Bureau\Play Poker.url
C:\Documents and Settings\All Users\Bureau\PopUp Blocker.url
C:\Documents and Settings\All Users\Bureau\Porn Dvd.url
C:\Documents and Settings\All Users\Bureau\Real Estate.url
C:\Documents and Settings\All Users\Bureau\Sport Betting.url
C:\Documents and Settings\All Users\Bureau\Spyware Remover.url
C:\Documents and Settings\All Users\Bureau\Texas Holdem.url
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\System32\vxgame3.exe
O2 - BHO: C:\WINDOWS\system32\st3.dll - {1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5} - C:\WINDOWS\system32\st3.dll
O2 - BHO: C:\WINDOWS\adsldpbd.dll - {826B2228-BC09-49F2-B5F8-42CE26B1B711} - C:\WINDOWS\adsldpbd.dll
O2 - BHO: (no name) - {9C5875B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\performent217.dll
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\zolker011.dll
O2 - BHO: ZToolbar Activator Class - {FFF5092F-7172-4018-827B-FA5868FB0478} - C:\WINDOWS\System32\ztoolb011.dll
O3 - Toolbar: ZToolbar - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - C:\WINDOWS\System32\ztoolb011.dll
O4 - HKLM\..\Run: [multitran]
O4 - HKLM\..\RunServices: [multitran]
O4 - HKLM\..\Run: [WindowsUpdateNT]
O4 - HKCU\..\Run: [multitran]
O4 - HKCU\..\Run: [WindowsUpdateNT]
O20 - Winlogon Notify: gg - C:\WINDOWS\adsldpbd.dll
O20 - Winlogon Notify: nuclabdll - C:\WINDOWS\SYSTEM32\nuclabdll.dll
O20 - Winlogon Notify: st3 - C:\WINDOWS\system32\st3.dll


Version 1.92

%system%\cvxh8jkdq?.exe
%system%\sdfdil.exe
%system%\winldra.exe
%windows%\blank.mht
O4 - HKLM\...\Run: [load32]


Version 1.91

%system%\split.exe
%system%\split1.exe
%system%\split2.exe
%system%\maxd1.exe
%system%\efsdfgxg.exe
%system%\birdihuy.dll
%system%\birdihuy32.dll
%system%\web.exe
%system%\yaemu.exe
%system%\svchop.exe
%system%\shdochop.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main: [Start Page]
O4 - HKLM\...\Run: [Explorer32]
O4 - HKLM\...\Run: [yaemu.exe]
O4 - HKLM\...\Run: [FH]
HKEY_CLASSES_ROOT\CLSID\{F33812FB-F35C-4674-90F6-FD757C419C51}
HKEY_CURRENT_USER\Software\Classes\CLSID\{F33812FB-F35C-4674-90F6-FD757C419C51}


Version 1.89

%system%\shdocnva.dll
HKLM\SOFTWARE\PSGuard.com

Version 1.88

%windir%\warnhp.html


Version 1.87

O4 - HKLM\..\Run: [P.S.Guard]
O4 - HKLM\..\Run: [AdService]
O4 - HKLM\..\Run: [FSH]
%ProgramFiles%\P.S.Guard\
%system%\AdService.dll
%system%\svcnva.exe


Version 1.86

%homedrive%\loader.exe
%windir%\kl.exe
%windir%\ms1.exe
%system%\cmdtel.exe
%system%\combo.exe
%system%\doser.exe
%system%\latest.exe
%system%\paytime.exe
%system%\sender.exe
%system%\socks.exe
%system%\sysvcs.exe
%system%\zlbw.dll
O4 - HKLM\..\Run: [combo.exe]
O4 - HKLM\..\Run: [PayTime]
O4 - HKCU\..\Run: [aupd]
O4 - HKCU\..\Run: [PayTime]


Version 1.85

[HKey_Classes_Root\CLSID\{17E02586-A91D-4A9D-A74E-187B05DFFE6F}]
[HKey_Classes_Root\CLSID\{1BD98DFD-2DA9-4C54-85D7-BE03A0F9C487}]
[HKey_Classes_Root\CLSID\{1C94EA51-3800-4F08-B5DC-A5B67823FFEA}]
[HKey_Classes_Root\CLSID\{20D1AF34-6E19-42D8-AF9F-BDFBE45C2454}]
[HKey_Classes_Root\CLSID\{21E132C9-1F98-4151-BDAD-7D9B49C60A8E}]
[HKey_Classes_Root\CLSID\{23F7AD29-F51A-4BA1-BE70-143B1CB25BD1}]
[HKey_Classes_Root\CLSID\{2C59D5EC-6B91-4896-BD6F-5F121D87A7F8}]
[HKey_Classes_Root\CLSID\{2F34E0E0-F0BB-477F-AFB8-509262FA0AD1}]
[HKey_Classes_Root\CLSID\{35ED274E-3F42-4A78-BBDC-3B7D73E85578}]
[HKey_Classes_Root\CLSID\{3D74D140-F780-4AE3-8D6D-F8DC39107213}]
[HKey_Classes_Root\CLSID\{49443D6E-CE4E-47A9-8DEB-F5774CE14984}]
[HKey_Classes_Root\CLSID\{52034AD2-914C-4634-B375-9299631E5525}]
[HKey_Classes_Root\CLSID\{7702C521-76AE-42C0-A181-3B5A96C2EEF7}]
[HKey_Classes_Root\CLSID\{7ADDA344-1D36-4446-9F4B-B2351FB19EFD}]
[HKey_Classes_Root\CLSID\{7D98221E-AF8F-4D29-8BB1-1DFABC288173}]
[HKey_Classes_Root\CLSID\{9746B450-6064-4EC8-9480-72A289AA2237}]
[HKey_Classes_Root\CLSID\{C5A40FCE-0A0F-40CA-985E-661C28B5B431}]
[HKey_Classes_Root\CLSID\{C7F22879-7151-4C71-8C50-9557AFDA66C6}]
[HKey_Classes_Root\CLSID\{CA5E7959-60B5-47B7-80AC-1606309733F3}]
[HKey_Classes_Root\CLSID\{CEABF027-6CDC-4D47-ADF6-AC5D065826A6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15DC7116-E58E-4395-A45A-A1C99B17C030}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17E02586-A91D-4A9D-A74E-187B05DFFE6F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BD98DFD-2DA9-4C54-85D7-BE03A0F9C487}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C94EA51-3800-4F08-B5DC-A5B67823FFEA}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D1AF34-6E19-42D8-AF9F-BDFBE45C2454}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21E132C9-1F98-4151-BDAD-7D9B49C60A8E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23F7AD29-F51A-4BA1-BE70-143B1CB25BD1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C59D5EC-6B91-4896-BD6F-5F121D87A7F8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F34E0E0-F0BB-477F-AFB8-509262FA0AD1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35ED274E-3F42-4A78-BBDC-3B7D73E85578}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3D74D140-F780-4AE3-8D6D-F8DC39107213}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49443D6E-CE4E-47A9-8DEB-F5774CE14984}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52034AD2-914C-4634-B375-9299631E5525}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7702C521-76AE-42C0-A181-3B5A96C2EEF7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ADDA344-1D36-4446-9F4B-B2351FB19EFD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D98221E-AF8F-4D29-8BB1-1DFABC288173}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9746B450-6064-4EC8-9480-72A289AA2237}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C5A40FCE-0A0F-40CA-985E-661C28B5B431}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7F22879-7151-4C71-8C50-9557AFDA66C6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA5E7959-60B5-47B7-80AC-1606309733F3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CEABF027-6CDC-4D47-ADF6-AC5D065826A6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E0AA0493-C410-4CBD-B1DB-1723374FA8E0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E5D78BD8-3874-4AA0-9D45-CFB79382C484}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"wininet.dll"="mscornet.exe"
"kernel32.dll"="C:\WINDOWS\System32\mssearchnet.exe"
"nvctrl.exe"="nvctrl.exe"
SOFTWARE\Classes\CLSID\{893FAD3A-931E-4E53-B515-B1426D63799B}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Currentversion\Explorer\Browser Helper Objecta\{893fad3a-931e-4e53-b515-b1426d63799b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Currentversion\Explorer\Browser Helper Objects\{893fad3a-931e-4e53-b515-b1426d63799b}]
%system%\mscornet.exe
%system%\mssearchnet.exe
%system%\nvctrl.exe
%system%\ncompat.tlb
%system%\msvol.tlb
%system%\ld????.tmp
%appdata%\Shudder Global Limited\
%appdata%\PSGuard.com\


Version 1.84

%system%\casino.ico
%system%\date.ico
%system%\games.ico
%system%\mobile.ico
%system%\network.ico
%system%\pharm.ico
%system%\pharm2.ico
%system%\scanner.ico
%system%\spam.ico
%system%\spyware.ico


Version 1.82

C:\Windows\tool1.exe
C:\Windows\tool3.exe
C:\Windows\tool4.exe
C:\Windows\tool5.exe
C:\Windows\__delete_on_reboot__popuper.exe
C:\WINDOWS\system32\svcnt32.exe
C:\Windows\System32\__delete_on_reboot__intmon.exe
C:\Windows\System32\__delete_on_reboot__intel32.exe
C:\Windows\System32\__delete_on_reboot__intell32.exe
C:\Windows\System32\__delete_on_reboot__OLEADM.dll
C:\Windows\System32\Air Tickets.ico
C:\Windows\System32\Big Tits.ico
C:\Windows\System32\Blackjack.ico
C:\Windows\System32\Britney Spears.ico
C:\Windows\System32\Car Insurance.ico
C:\Windows\System32\Cheap Cigarettes.ico
C:\Windows\System32\Credit Card.ico
C:\Windows\System32\Cruises.ico
C:\Windows\System32\Currency Trading.ico
C:\Windows\System32\Lesbian Sex.ico
C:\Windows\System32\MP3.ico
C:\Windows\System32\Online Betting.ico
C:\Windows\System32\Online Gambling.ico
C:\Windows\System32\Oral Sex.ico
C:\Windows\System32\Party Poker.ico
C:\Windows\System32\Pharmacy.ico
C:\Windows\System32\Phentermine.ico
C:\Windows\System32\Pornstars.ico
C:\Windows\System32\Remove Spyware.ico
C:\Windows\System32\viagra.ico
C:\Documents and Settings\****\Desktop\Air Tickets.url
C:\Documents and Settings\****\Desktop\AntivirusGold.lnk
C:\Documents and Settings\****\Desktop\Big Tits.url
C:\Documents and Settings\****\Desktop\Blackjack.url
C:\Documents and Settings\****\Desktop\Britney Spears.url
C:\Documents and Settings\****\Desktop\Car Insurance.url
C:\Documents and Settings\****\Desktop\Cheap Cigarettes.url
C:\Documents and Settings\****\Desktop\Credit Card.url
C:\Documents and Settings\****\Desktop\Cruises.url
C:\Documents and Settings\****\Desktop\Currency Trading.url
C:\Documents and Settings\****\Desktop\Lesbian Sex.url
C:\Documents and Settings\****\Desktop\MP3.url
C:\Documents and Settings\****\Desktop\Online Betting.url
C:\Documents and Settings\****\Desktop\Online Gambling.url
C:\Documents and Settings\****\Desktop\Oral Sex.url
C:\Documents and Settings\****\Desktop\Party Poker.url
C:\Documents and Settings\****\Desktop\Pharmacy.url
C:\Documents and Settings\****\Desktop\Phentermine.url
C:\Documents and Settings\****\Desktop\Pornstars.url
C:\Documents and Settings\****\Desktop\Remove Spyware.url
C:\Documents and Settings\****\Desktop\SpySheriff.lnk
C:\Documents and Settings\****\Desktop\viagra.url
O4 - HKLM\..\Run: [Start Page]


Version 1.8

C:\Program Files\internet explorer\ieengine.exe
O4 - HKCU\..\Run: [IEengine]
[-HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD\PSGuard]


Version 1.7

F2 - REG:system.ini: Shell=Explorer.exe sysinit32z.exe
C:\WINDOWS\system32\sysinit32z.exe
C:\WINDOWS\system32\taras.exe


Version 1.6

C:\Windows\tool2.exe


Version 1.5

C:\ntdetecd.exe
C:\Windows\System32\vxh8jkdq?.exe


Version 1.4

C:\Program Files\Daily Weather Forecast\
04 - HKLM\..\Run: [Daily Weather Forecast]


Version 1.3

C:\Windows\System32\oleext.dll
C:\Windows\System32\oleext32.dll
C:\Windows\System32\wppp.html
O4 - HKCU\..\Run: [SNInstall]


Version 1.1

C:\Program Files\SpyKiller\
C:\Windows\System\svchost.exe
C:\Windows\System32\intell32.exe
C:\Windows\System32\kernels32.exe
C:\Windows\System32\vxgame?.exe
C:\Windows\System32\vxgamet?.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O4 - HKCU\..\Run: [SpyKiller]
O4 - HKLM\..\Run: [intell32.exe]
O4 - HKLM\..\Run: [System]
O4 - HKLM\..\Run: [WindowsUpdate]
O4 - HKLM\..\RunServices: [SystemTools]


Version 1.0

C:\Windows\System32\gunist.exe
C:\Windows\System32\param32.dll
C:\Windows\System32\pop_up.dll
C:\Windows\System32\searchdll.dll
C:\Windows\System32\svchosts.dll
C:\Windows\System32\LogFiles\T54111925.so
C:\Windows\System32\LogFiles\H53131712.so
C:\Windows\System32\LogFiles\A54102200.so
C:\Windows\System32\LogFiles\S53252000.so
C:\Windows\System32\LogFiles\A04111925.so
C:\Windows\System32\LogFiles\M54111925.so
C:\Windows\System32\LogFiles\P54111925.so


Version 0.x

C:\bsw.exe
C:\r.exe
C:\winstall.exe
C:\wp.bmp
C:\wp.exe
C:\Windows\desktop.html
C:\Windows\popuper.exe
C:\Windows\screen.html
C:\Windows\sites.ini
C:\Windows\uninstIU.exe
C:\Windows\windows.html
C:\Windows\zloader3.exe
C:\Windows\System32\helper.exe
C:\Windows\System32\hhk.dll
C:\Windows\System32\hookdump.exe
C:\Windows\System32\hp????.tmp
C:\Windows\System32\intel32.exe
C:\Windows\System32\intmon.exe
C:\Windows\System32\intmonp.exe
C:\Windows\System32\msmsgs.exe
C:\Windows\System32\msole32.exe
C:\Windows\System32\ole32vbs.exe
C:\Windows\System32\oleadm.dll
C:\Windows\System32\oleadm32.dll
C:\Windows\System32\perfcii.ini
C:\Windows\System32\runsrv32.dll
C:\Windows\System32\runsrv32.exe
C:\Windows\System32\shnlog.exe
C:\Windows\System32\spoolsrv32.exe
C:\Windows\System32\srpcsrv32.dll
C:\Windows\System32\srpcsrv32.exe
C:\Windows\System32\svcnt.exe
C:\Windows\System32\txfdb32.dll
C:\Windows\System32\w8673492.exe
C:\Windows\System32\winnook.exe
C:\Windows\System32\wldr.dll
C:\Windows\System32\wp.bmp
C:\Windows\System32\LogFiles\A5281300.so
C:\Windows\web\desktop.html
C:\Windows\web\wallpaper.html
C:\Documents and Settings\****\Application Data\Install.dat
C:\Program Files\AdwareDelete\
C:\Program Files\AntivirusGold\
C:\Program Files\PSGuard\
C:\Program Files\Search Maid\
C:\Program Files\Security IGuard\
C:\Program Files\SpySheriff\
C:\Program Files\Virtual Maid\
C:\spywarevanisher-free\
O4 - HKCU\..\Run: [Intel system tool]
O4 - HKCU\..\Run: [SpySheriff]
O4 - HKCU\..\Run: [Windows installer]
O4 - HKCU\..\Run: [WindowsFY]
O4 - HKCU\..\Run: [WindowsFZ]
O4 - HKLM\..\Run: [Fast Start]
O4 - HKLM\..\Run: [intel32.exe]
O4 - HKLM\..\Run: [Intel system tool]
O4 - HKLM\..\Run: [MSN Messenger]
O4 - HKLM\..\Run: [PSGuard]
O4 - HKLM\..\Run: [PSGuard spyware remover]
O4 - HKLM\..\Run: [RegSvr32]
O4 - HKLM\..\Run: [WindowsFZ]
[-HKEY_CURRENT_USER\SOFTWARE\SpySheriff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusGold]
[-HKEY_LOCAL_MACHINE\SOFTWARE\AdwareDelete]
VideoAccessCodec